IRSE News 176 Mar 12 with Watermark.pdf
IRSE News 176 Mar 12 with Watermark.pdf IRSE News 176 Mar 12 with Watermark.pdf
IRSE NEWS ISSUE 176 MARCH 2012
- Page 2 and 3: TEN 01/10 Annuncio 190x130 mm.qxd:0
- Page 4 and 5: MARCH TECHNICAL PAPER From Safety t
- Page 6 and 7: MARCH TECHNICAL PAPER no checks on
- Page 8 and 9: MARCH TECHNICAL PAPER The function
- Page 10 and 11: MARCH TECHNICAL PAPER In other word
- Page 12 and 13: WEN ZHOU 8:12 pm Train D301 arrives
- Page 14 and 15: IRSE CONVENTION - PART 2 Some indiv
- Page 16 and 17: IRSE CONVENTION - PART 2 equipment
- Page 18 and 19: IRSE CONVENTION - PART 2 hillsides
- Page 20 and 21: IRSE CONVENTION - PART 2 Frank open
- Page 22 and 23: LU TECHNICAL SOCIETY London Undergr
- Page 24 and 25: YORK SECTION Report by Andrew P Smi
- Page 26 and 27: ANNOUNCEMENTS SIMS signals the go a
- Page 28: MEMBERSHIP MATTERS ELECTIONS We ext
<strong>IRSE</strong> NEWS<br />
ISSUE <strong>176</strong> MARCH 20<strong>12</strong>
TEN 01/10 Annuncio 190x130 mm.qxd:01/10 Tenconi Annuncio 190x130 mm 8.6.2010 15:20 Pagina 1<br />
Manufacture of Insulated Rail Joints<br />
in Hardomid for Railways and of<br />
special hollow sleepers<br />
TENCONI plastic division is the only manufacturer of the high quality insulated<br />
rail joints also called "BENKLER" joints. The pieces are produced also in small<br />
batches, according to customers' specifications and needs.<br />
TENCONI steel construction department has a reputation of excellence also for the<br />
manufacture of special steel hollow sleepers, low friction slide chairs, insulated base<br />
plates and many other railway products.<br />
TENCONI SA<br />
Mechanical workshop<br />
CH-6780 Airolo<br />
For more information contact:<br />
Sales manager: Fabrizio Lucchini<br />
Tel.: +41 91 873 30 00<br />
Mobile: +41 79 435 59 84<br />
E-Mail: lucchinifabrizio@ tenconi.ch<br />
Front Cover:<br />
The Traffic Control Centre for Keretapi Tanah Melayu Behad (KTMB) located at Kuala Lumpur Sentral, taken on Friday 14 October<br />
2011 during Convention Visit . The area of control includes Rawang - Ipoh Double Track (RIDT), Klang Valley Double Track (KVDT)<br />
and Sentul Batu Caves double track sector.<br />
Photo: Ian James Allison
NEWS VIEW <strong>176</strong><br />
Border Challenge<br />
<strong>IRSE</strong> NEWS is published monthly by the Institution of<br />
Railway Signal Engineers (<strong>IRSE</strong>). The <strong>IRSE</strong> is not as a<br />
body responsible for the opinions expressed in<br />
<strong>IRSE</strong> NEWS.<br />
© Copyright 20<strong>12</strong>, <strong>IRSE</strong>. All rights reserved.<br />
No part of this publication may be reproduced,<br />
stored in a retrieval system, or transmitted in any<br />
form or by any means <strong>with</strong>out the permission in<br />
writing of the publisher. Copying of articles is not<br />
permitted except for personal and internal use.<br />
Multiple copying of the content of this publication<br />
<strong>with</strong>out permission is always illegal.<br />
Editor<br />
Ian J Allison<br />
31 Bainbridge Road, Loughborough, LE11 2LE, UK<br />
Tel: +44 (0) 7794 879286<br />
e-mail: irsenews@btinternet.com<br />
Deputy Editor<br />
Tony Rowbotham<br />
36 Burston Drive, Park Street, St Albans, AL2 2HP, UK<br />
e-mail: irsenews@aol.com<br />
Assistant Editors<br />
(Africa) Harry Ostrofsky<br />
e-mail: thehzos@icon.co.za<br />
(Australasia) Tony Howker<br />
e-mail: ahowker@bigpond.com<br />
(N. America) David Thurston<br />
e-mail: david.thurston@parsons.com<br />
(Asia) Buddhadev Dutta Chowdhury<br />
e-mail: bduttac@gmail.com<br />
(Europe) Wim Coenraad<br />
e-mail: wimcoenraad@me.com<br />
(Younger Nigel Handley e-mail:<br />
Members) nigel.handley@signallingsolutions.com<br />
Contributions<br />
Articles of a newsworthy or technical nature are always<br />
welcome for <strong>IRSE</strong> NEWS. Members should forward<br />
their contributions to one of the Editors listed above.<br />
Advertising<br />
For advertising rates and deadlines call<br />
Claire Barber at Ten Alps Media<br />
Tel: +44 (0)20 7878 2319<br />
Fax: +44 (0)20 7379 7118<br />
e-mail: Claire.Barber@tenalps.com<br />
Advertisements are accepted on the basis that the<br />
advertiser and agency (if any) warrant that the contents<br />
are true and correct in all respects.<br />
Web Site<br />
For up to date information about the Institution or its<br />
activities, or to download a membership application<br />
form, log on to the <strong>IRSE</strong> Web Site: www.irse.org<br />
London Office<br />
<strong>IRSE</strong>, 4 th Floor, 1 Birdcage Walk, Westminster,<br />
London, SW1H 9JJ, United Kingdom<br />
Enquiries<br />
MEMBERSHIP OR OF A GENERAL NATURE<br />
Tel: +44 (0)20 7808 1180<br />
Fax: +44 (0)20 7808 1196<br />
e-mail: hq@irse.org<br />
PROFESSIONAL DEVELOPMENT<br />
Tel: +44 (0)20 7808 1186<br />
e-mail: training@irse.org<br />
LICENSING<br />
Tel: +44 (0)20 7808 1190<br />
e-mail: licensing@irse.org<br />
Back in July 2008, through this same medium of <strong>News</strong> View (edition 136),<br />
I expressed an aspiration for the Borders Rail Link in Scotland to be signalled<br />
in a manner suitable to its needs and (to use a popular Scottish term) out<strong>with</strong><br />
the constraints of the standards prescribed by the UK’s national infrastructure<br />
owner.<br />
Given the original thrust for the route to be constructed by a third party<br />
<strong>with</strong> the ability to provide an enlightened solution embracing fresh thinking,<br />
innovation and commensurate technology for this blank canvas was highly<br />
plausible. This would have given us S&T engineers a unique challenge in an<br />
otherwise monotone future. It could have revealed our skills and given our<br />
profession a fillip, raising our profile and gaining us new respect.<br />
Sadly, the procurement competition to finance, design, build and maintain<br />
this line foundered, <strong>with</strong> the result that it is now to be built by Network Rail.<br />
Refresh your memory of the words contained in <strong>News</strong> View 136 and join<br />
me in lamenting what will probably now turn out to be a lost opportunity<br />
unless Network Rail has the courage to recognise the potential. So I call on<br />
Network Rail’s S&T engineers to stand up and show how they would relish<br />
this chance they have been given to confound the critics, including myself, by<br />
delivering a solution that does not just “paint by numbers” but which really<br />
looks at the fundamentals in order to match rolling stock, service pattern,<br />
availability and efficiency to this “green field” railway.<br />
J.D. Francis<br />
IN THIS ISSUE<br />
©<br />
NOT FOR RE-PRINTING<br />
Page<br />
From Safety to Security – How Secure is ERTMS? (London <strong>Mar</strong>ch Paper) 2<br />
Dr Robert Stroud and Professor Robin Bloomfield<br />
Wen Zhou: What went wrong? 9<br />
George Nikandros<br />
Industry <strong>News</strong> 11<br />
<strong>IRSE</strong> International Convention 2011: Part 2 <strong>12</strong><br />
Tuesday 11 October 2011 Trevor Foulkes <strong>12</strong><br />
Wednesday <strong>12</strong> October 2011 Ian Bridges 13<br />
The Guest Perspective Lyn Burkhardt 15<br />
The Future Beckons Nine Younger Members 17<br />
<strong>IRSE</strong> Matters 19<br />
<strong>IRSE</strong> Professional Examination: Results 2011 19<br />
London Underground’s Technical Society 20<br />
York Section January Meeting 22<br />
Midland & North Western Section January Meeting 23<br />
Feedback 22<br />
Announcements 24<br />
SIMS Apprenticeships 24<br />
M&NW Section Ninth Annual Luncheon & Technical Visit 24<br />
<strong>IRSE</strong> Wing Award for Safety: Call for Nominations 20<strong>12</strong> 25<br />
<strong>IRSE</strong> Merit Awards: Call for Nominations 20<strong>12</strong> 25<br />
Younger Members Technical Papers Competition: Call for Papers 25<br />
Membership Matters 26<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong><br />
1
MARCH TECHNICAL PAPER<br />
From Safety to Security – How Secure is ERTMS?<br />
by Dr Robert Stroud and Professor Robin Bloomfield<br />
Both authors are <strong>with</strong> Adelard LLP. Robin Bloomfield is a Professor in the Centre for Software Reliability at City University, London<br />
Paper to be read in London on 8 <strong>Mar</strong>ch 20<strong>12</strong><br />
INTRODUCTION<br />
The European Railway Traffic Management System (ERTMS) is a<br />
major industrial project that aims at replacing the many different<br />
national train control and command systems in Europe. The<br />
deployment of ERTMS will support the creation of a seamless<br />
European railway system and increase the competitiveness of<br />
European railways.<br />
ERTMS consists of two major components:<br />
ETCS, the European Train Control System, is a train control<br />
and Automatic Train Protection system (ATP) to replace the<br />
existing national systems;<br />
GSM-R is a radio system for providing voice and data<br />
communication between the track and the train, using GSM<br />
technology over frequencies reserved for railway use.<br />
Network Rail is preparing to introduce ETCS and GSM-R as part<br />
of the upgrade of the signalling and communications systems<br />
running on the rail infrastructure in Great Britain. Within the rail<br />
industry safety has always been paramount, but security has not<br />
always been considered. However this upgrade has the<br />
potential to increase the risk of an electronic attack on the rail<br />
infrastructure, as it brings more systems under centralised<br />
control.<br />
This paper reports on the results of a security audit of ERTMS<br />
that was commissioned by the Centre for the Protection of<br />
National Infrastructure (CPNI) on behalf of key railway<br />
stakeholders. We first discuss the ERTMS/ETCS specifications<br />
from a security perspective and then contrast our results <strong>with</strong> the<br />
safety requirements for ERTMS, highlighting areas where<br />
different assumptions about the threat model lead to different<br />
concerns.<br />
OVERVIEW OF ERTMS<br />
The ERTMS/ETCS System Requirements Specification (SRS)<br />
(Ref. 1) provides a technical specification of the overall system.<br />
Figure 1, which is taken from the SRS, provides a simplified<br />
view of the ERTMS/ETCS reference architecture. The trackside<br />
sub-system consists of balises (track-mounted devices that<br />
communicate <strong>with</strong> passing trains), the radio communication<br />
system (GSM-R), and Radio Block Centres (RBCs). The RBCs<br />
issue movement authorities to trains on the basis of information<br />
received from external trackside systems and information<br />
exchanged <strong>with</strong> the on-board systems.<br />
The on-board system receives movement authorities from an<br />
RBC via radio messages, and calculates a speed profile for the<br />
track ahead based on the braking characteristics of the train and<br />
the safe speed limits for the track conditions. Although the<br />
driver remains in control of the train, the system will supervise<br />
the maximum speed of the train, and ensure that the brakes are<br />
applied automatically if the train exceeds the safe speed limit for<br />
a particular section of track, or is in danger of not being able to<br />
2<br />
NOT FOR RE-PRINTING<br />
©<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong><br />
Figure 1: The reference architecture of ERTMS/ETCS<br />
stop before the end of its movement authority. Balises are used<br />
to provide the train <strong>with</strong> location references, so that it can<br />
correct for any errors in its odometry, and keep the RBC<br />
informed about its current position.<br />
As the train progresses along its allocated route, it keeps the<br />
RBC informed about its current position, and as track becomes<br />
available, the RBC extends the train’s movement authority so<br />
that the train is able to maintain an optimal speed for the traffic<br />
conditions ahead.<br />
THREATS AND HAZARDS<br />
A safety analysis usually starts by identifying the core hazard and<br />
then examining potential failure modes that could cause that<br />
hazard, but a security analysis considers a rather different set of<br />
potential threats and undesirable consequences.<br />
Traditionally, computer security deals <strong>with</strong> threats to<br />
confidentiality, integrity, and availability, but here we are<br />
concerned <strong>with</strong> train movements rather than information, so our<br />
primary concern is integrity, then availability, and finally<br />
confidentiality. Loss of integrity could result in accidents or<br />
collisions, whereas loss of availability would bring the railway<br />
system to a halt. Loss of confidentiality is less of an immediate<br />
threat, but might result in the leak of sensitive operational<br />
information. Reliability is also important, since an unreliable train<br />
service will result in a loss of public confidence in the railway<br />
operators.
Thus, the hazards or potential failures to be avoided are the<br />
following:<br />
a collision involving multiple trains;<br />
an accident such as derailment involving a single train;<br />
widespread disruption of train service over a large area;<br />
disruption to individual trains, or trains <strong>with</strong>in a local area;<br />
creation of a situation that leads to panic and potential loss of<br />
life (e.g., an emergency stop and uncontrolled evacuation on to<br />
the track);<br />
creation of a situation that leads to passenger discomfort and<br />
dissatisfaction, (e.g., stopping a train indefinitely in a tunnel);<br />
loss of public confidence in the railway system due to<br />
intermittent low-level problems affecting the reliability of the<br />
service;<br />
leak of sensitive information (e.g., movements of hazardous<br />
cargoes or VIPs).<br />
Note that these hazards are concerned <strong>with</strong> system-wide failures<br />
whereas the safety analysis only deals <strong>with</strong> the failure of a single<br />
train. Similarly, a safety analysis is only concerned <strong>with</strong> accidents<br />
resulting from a hazard; reliability and availability are treated<br />
separately, and confidentiality is not usually an issue. However<br />
faults that could result in an accident need to be considered in both<br />
a safety and security analysis, regardless of the underlying cause of<br />
the fault (accidental, deliberate or malicious).<br />
A security analysis also needs to consider the capabilities of the<br />
attacker. It is usual to make a distinction between an insider and an<br />
outsider. An insider is someone <strong>with</strong> legitimate access to a system<br />
who abuses their position and privileges, either willingly or under<br />
duress; whereas an outsider is someone outside the system <strong>with</strong><br />
limited access, who seeks to break into the system out of curiosity,<br />
malice, or for personal gain. Historically, railway systems have<br />
relied on highly specialised, proprietary technology, and there has<br />
been a relatively small community <strong>with</strong> the necessary knowledge to<br />
exploit vulnerabilities. However the widespread adoption of open<br />
standards like ERTMS, that are designed to promote<br />
interoperability and the commoditisation of technology, could<br />
result in both the necessary knowledge and the necessary tools<br />
becoming more readily available to potential attackers who are<br />
sufficiently motivated to gain the necessary skills.<br />
ERTMS FROM A SECURITY PERSPECTIVE<br />
NOT FOR RE-PRINTING<br />
Our approach to the security analysis has been to consider the<br />
context in which ERTMS operates, and its relationship <strong>with</strong> other<br />
systems. ERTMS is implemented using a number of trackside and<br />
on-board sub-systems, and the ERTMS/ETCS specifications<br />
describe the interfaces by which these various sub-systems interact,<br />
and how the ETCS application responds to messages via these<br />
interfaces and ensures that trains move safely <strong>with</strong>out exceeding<br />
their movement authority.<br />
It is important to note that the ERTMS/ETCS specifications only<br />
deal <strong>with</strong> the interoperability requirements of a European Railway<br />
Traffic Management System, and therefore do not cover the<br />
interfaces that are used by each national railway to control and<br />
manage its own infrastructure. This limits the scope of any security<br />
or safety analysis to interactions between the various components<br />
of the ERTMS/ETCS architecture<br />
©<br />
Messages are transmitted between the ERTMS/ETCS subsystems<br />
over various channels, so a security analysis needs to<br />
consider whether these channels can be trusted to deliver the<br />
messages reliably or whether an attacker can interfere <strong>with</strong> the<br />
delivery channels in some way. Safety measures that guard<br />
against random errors caused by environmental noise are not<br />
robust against deliberate attempts to corrupt the channel,<br />
because errors are then no longer random. A security analysis<br />
also needs to consider what might happen if a particular<br />
component of the system were compromised in some way.<br />
For example, ERTMS is designed to prevent the driver from<br />
exceeding the safe speed limit by accident, but is it possible<br />
for the driver to bypass ERTMS in some way and remove this<br />
protection, and how does the system deal <strong>with</strong> this possibility?<br />
A security analysis therefore needs to consider:<br />
whether there are safeguards built into the system that<br />
protect against messages being corrupted in transmission<br />
by the input channel;<br />
whether these safeguards protect against all possible<br />
threats to the input channel (e.g., deliberate attacks on the<br />
channel, as opposed to random failures of the channel);<br />
whether the source of the input is trustworthy, or whether<br />
it is possible for the input source to have been<br />
compromised;<br />
whether there is adequate protection at the application<br />
level to guard against malicious messages generated by an<br />
attacker who controls the input source.<br />
The on-board system needs to interact <strong>with</strong> the driver, the<br />
train, the balises, and the radio block centres. So the on-board<br />
system either needs to trust these components of the ERTMS<br />
system absolutely, which means that it is vulnerable to abuse if<br />
these components are compromised, or else take appropriate<br />
steps to guard against potential failures and compromises of<br />
these components.<br />
Moreover, the ERTMS/ETCS system needs to ensure that<br />
the channels of communication between these components<br />
are trustworthy, or else an outsider could compromise the<br />
system by disrupting communications and either injecting false<br />
messages or modifying or deleting correct messages.<br />
Communication Channels<br />
We start by examining the communication channels from a<br />
security perspective. The ERTMS/ETCS architecture involves<br />
two kinds of communication: on-board and train/trackside.<br />
On-board Communications<br />
The driver and the train itself are part of the on-board train<br />
system, and therefore the security of the channels between the<br />
driver/train and the ETCS application depends on the physical<br />
security of the train (e.g., the use of a special driver’s key to<br />
operate the driver’s console, and the integrity of the traction<br />
equipment). Although it would be possible for an attacker to<br />
tamper <strong>with</strong> these physical interfaces, this kind of attack falls<br />
outside the scope of an information assurance audit of ERTMS.<br />
Nevertheless, it is worth mentioning that the ERTMS/ETCS<br />
specifications provide no protection for the ETCS/Train<br />
interface and the ETCS/Driver interface. In particular there are<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong> 3
MARCH TECHNICAL PAPER<br />
no checks on the integrity or authenticity of the messages<br />
exchanged over these channels, because they are assumed to be<br />
part of a closed system. The driver interacts directly <strong>with</strong> ETCS<br />
via the driver’s control panel, and ETCS interacts directly <strong>with</strong> the<br />
train via an electro-mechanical interface, and there is assumed to<br />
be no possibility of intervention or compromise.<br />
The weakness <strong>with</strong> this approach is the assumption that ETCS<br />
remains a closed system. For various economic and practical<br />
reasons, there is a trend towards integrated control systems<br />
based on commodity components, and towards the use of<br />
shared communication networks between the various on-board<br />
train systems. If ETCS were to be accessible over such a network<br />
<strong>with</strong>out adequate authentication or integrity checking, it would<br />
be possible for any system connected to the network to interfere<br />
<strong>with</strong> the correct operation of the ERTMS system, either<br />
accidentally or deliberately. For example, a virus on a<br />
passenger’s laptop computer could try to spread itself via the<br />
train’s communication network, which could result in the train<br />
control system malfunctioning.<br />
Train/Trackside Communications<br />
The other channels of communication are between the train and<br />
the trackside, and these therefore have to cross the air gap,<br />
which is assumed to be untrustworthy. One channel is between<br />
the train and the RBC, which is secured using the Euroradio<br />
protocol. The other channel is between the train and the balises,<br />
where the air gap interface is protected by an elaborate<br />
encoding scheme to guard against accidental loss or corruption,<br />
but is assumed to be tamperproof by its very nature.<br />
Trust relationships<br />
We now explore the trust relationships between the various<br />
components of the ERTMS/ETCS architecture.<br />
ETCS – Driver<br />
The driver is trusted to enter correct data about the train’s<br />
braking requirements, and to operate the ETCS system in a<br />
responsible fashion. In particular, although the driver’s actions<br />
are normally supervised by ETCS, it is possible for the driver to<br />
disable the ETCS system completely, and then drive the train in<br />
an unsupervised fashion <strong>with</strong>out any speed restrictions or<br />
interventions if the train exceeds its movement authority.<br />
However, because there is an operational need for this<br />
functionality to be available (e.g., in an emergency or if the<br />
system breaks down), this vulnerability is unavoidable and drivers<br />
have to be trusted not to abuse their privileges. The only<br />
protection that can be provided is a set of operational<br />
procedures that drivers must follow, but these fall outside the<br />
scope of ERTMS and cannot be enforced or policed by an<br />
automated system.<br />
ETCS – Train<br />
NOT FOR RE-PRINTING<br />
©<br />
The on-board system has detailed knowledge of the train’s<br />
braking characteristics, the track adhesion conditions and the<br />
response time before full braking is enabled, and can therefore<br />
perform an accurate calculation about when to apply the brakes<br />
to bring the train to a halt. The train is trusted to apply the<br />
brakes on demand but the service brake is not required to be<br />
trustworthy; if the train does not respond to the service brake as<br />
expected, the emergency brake will be applied and this is<br />
assumed to be fail-safe. Track-based train detection equipment<br />
linked to the interlocking provides a final safeguard if a train<br />
overruns the end of its movement authority.<br />
To know when to apply the brakes, ETCS needs to keep track<br />
of the train’s current speed and position – this information is<br />
provided by a separate interface from ETCS, to an odometer<br />
device. The odometer is required to supply ETCS <strong>with</strong><br />
reasonably accurate information about the distance travelled,<br />
and ETCS can use this information to calculate an estimate of the<br />
train’s current location and speed. However, ETCS does not<br />
trust the odometer to provide completely precise distance<br />
measurements – instead, the odometer is expected to associate<br />
a confidence interval <strong>with</strong> all its measurements, and re-calibrate<br />
itself using location references received from the balises.<br />
Thus, in principle, ETCS guards against receiving inaccurate<br />
information about the speed and position of the train, but<br />
ultimately depends on an external position reference provided<br />
by the balises and its own internal time reference.<br />
ETCS – RBC<br />
The train interacts <strong>with</strong> the RBCs via a GSM-R radio link, and<br />
implicitly trusts the movement authorities and the data it<br />
receives from the RBCs about the track conditions ahead.<br />
However, the GSM-R network is not considered to be secure,<br />
and the Euroradio protocol (Ref. 2) is used to ensure that<br />
messages from RBCs cannot be forged or modified in<br />
transmission. This ensures that there is a secure channel of<br />
communication between the RBCs and the train.<br />
Euroradio only provides a basic transport service, <strong>with</strong> no<br />
error detection or error recovery. Thus protection against lost,<br />
duplicated, or out-of-order messages has to be provided at the<br />
ERTMS application level. In particular, messages are given a<br />
timestamp, and if no messages are received <strong>with</strong>in a given time<br />
window, the safe connection is released and set up again, <strong>with</strong><br />
the option of applying the service brake or tripping the system.<br />
Although Euroradio protects the train against attacks from<br />
outside the system, it does not protect the train against attacks<br />
from <strong>with</strong>in the system. In particular, if an attacker was able to<br />
compromise an RBC and cause it to issue false instructions, then<br />
a hazardous situation could arise.<br />
Clearly, the RBCs need to be protected against such attacks<br />
– an uncontrolled external interface to an RBC would be a major<br />
vulnerability. However, this falls outside the scope of the<br />
ERTMS/ETCS specifications, which are only concerned <strong>with</strong><br />
interoperability. The specifications only describe the messages<br />
exchanged between the RBCs and the train, and the protocol for<br />
handing on control of trains from one RBC to the next.<br />
The security of the Euroradio protocol depends on the<br />
existence of a secure mechanism for creating and distributing<br />
keys to trains and RBCs but this is not addressed by the<br />
specifications. However, in order to support interoperability<br />
across national borders, it is necessary to exchange keys<br />
between national implementations of ERTMS as a precondition<br />
for trains to be able to travel seamlessly from one country to the<br />
next under the control of ERTMS. Key exchange across national<br />
4<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong>
orders is covered by the specification of the off-line key<br />
management system (Ref. 3), which requires a secure<br />
implementation of a national key management centre for each<br />
country; the standard specifies a minimum set of security<br />
requirements that each national key management centre must<br />
meet.<br />
This is important because the security of ERTMS depends on<br />
the security of the key infrastructure – trains can only operate<br />
<strong>with</strong>in a given area if the RBC for that area and the train share a<br />
secret key, since otherwise they would not be able to<br />
communicate via Euroradio. So keys need to be distributed in<br />
advance as part of setting up cross-border train operations, and<br />
each national authority must be prepared to entrust its own keys<br />
to another national authority, which means that it needs to be<br />
satisfied that those keys will be managed securely by the foreign<br />
key management centre.<br />
There is also a requirement that all keys should be sufficiently<br />
strong and that no country should generate weak keys, since, if it<br />
were possible for an attacker to guess a national key, they could<br />
masquerade as a train or an RBC from that country, not only in<br />
the country whose keys had been compromised but also in any<br />
foreign country that had an interoperability agreement <strong>with</strong> that<br />
country.<br />
ETCS – Balise<br />
Balises are essentially unsecured devices and therefore represent<br />
a potential vulnerability in ERTMS. In particular, there are no<br />
robust authentication or integrity checks on the information<br />
provided by balises. However, some protection is built into the<br />
ETCS application.<br />
Specifically, ETCS distinguishes between linked balises and<br />
unlinked balises. Linked balises provide position references, and<br />
each movement authority contains details about the expected<br />
position of all the linked balises that the train should encounter<br />
during passage through that section of track. Because the<br />
movement authority is sent from the RBC to the train via a secure<br />
channel, this information is considered trustworthy. The ETCS<br />
application is designed to tolerate missing or misplaced balises,<br />
but these are assumed to be due to equipment failure or<br />
maintenance error rather than a deliberate attack.<br />
However, ETCS is also willing to accept information from<br />
balises that are not known to the RBC or that it is not informed<br />
about in advance. Such balises are known as unlinked balises<br />
and represent a major vulnerability to the system because an<br />
attacker can use an unlinked balise to feed malicious and<br />
untrustworthy commands to a train via a channel that the train<br />
implicitly trusts.<br />
The ERTMS/ETCS specifications presumably allow unlinked<br />
balises because there is an operational requirement for balises to<br />
be deployed temporarily, <strong>with</strong>out the need to re-programme the<br />
balise linking information held by RBCs (e.g., during track<br />
maintenance work). Whether this trade-off between risk and<br />
convenience is appropriate is debatable. Unfortunately, even<br />
though a national authority might decide not to deploy unlinked<br />
balises as part of its operational procedures, the potential<br />
vulnerability would remain because ERTMS requires all trains to<br />
NOT FOR RE-PRINTING<br />
©<br />
recognise unlinked balises and there is no facility for disabling<br />
this mechanism on a national basis.<br />
The list of commands that an ETCS system is willing to accept<br />
from an unlinked balise is not arbitrary; the specification<br />
attempts to make a distinction between information that is safety<br />
critical and should not be provided via an untrusted channel<br />
(e.g., movement authorities and track information), and<br />
information that it may be necessary to send from a balise for<br />
operational reasons (e.g., temporary speed restrictions).<br />
For example, unlinked balises cannot be used to issue an<br />
emergency stop command, although such commands can be<br />
issued via the RBC. This is presumably because there are more<br />
appropriate ways of alerting train drivers to an emergency<br />
situation (e.g., by using the emergency group call facility<br />
provided by GSM-R).<br />
However, almost all of the commands that can be issued by<br />
an unlinked balise could be exploited by an attacker to a greater<br />
or lesser extent. Most of these attacks would result in some<br />
form of denial of service, but some commands can be used to<br />
create a hazardous situation.<br />
Summary<br />
On-board channels of communication between components of<br />
ERTMS/ETCS are assumed not to need protection because the<br />
channels are not exposed to an attacker. Radio communications<br />
between the train and the trackside are protected by encryption,<br />
but the security of the system depends on the security of the<br />
underlying key management infrastructure. Communications<br />
across the air gap between balises and the train are protected<br />
from electromagnetic interference by an elaborate encoding<br />
scheme, but otherwise balises are assumed to be trustworthy<br />
and are not authenticated.<br />
The ETCS application provides some protection at the<br />
application level, but the safeguards are designed to protect<br />
against equipment failure and maintenance errors rather than<br />
deliberate attacks, and unlinked balises represent a particular<br />
threat. However, such an attack would require physical access to<br />
the track and could not be launched remotely or electronically.<br />
ERTMS FROM A SAFETY PERSPECTIVE<br />
The ERTMS safety analysis (Ref. 4) is based on a series of Failure<br />
Modes and Effects Analysis documents that identify “potentially<br />
catastrophic events that could exist at the mandatory boundaries<br />
of the UNISIG reference architecture”. The analysis considers<br />
the impact of these “potentially catastrophic events” on the<br />
overall safety of the ETCS application, and apportions the<br />
tolerable hazard rate to each subsystem accordingly. However,<br />
“failures that do not affect the safety of a passenger on the train<br />
are classed as RAM issues”. Thus, the focus is on safety rather<br />
than security, and events that might affect the availability of the<br />
service are not considered to be a threat to its safety, although<br />
they would be considered relevant from a security perspective.<br />
Nevertheless, a complete set of failure modes is identified for<br />
each interface, so the list of failure modes is still useful, even if<br />
the effects analysis is not always appropriate.<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong> 5
MARCH TECHNICAL PAPER<br />
The function of ETCS is specified as follows (all quotations are<br />
from Ref. 4): “To provide the Driver <strong>with</strong> information to allow<br />
him to drive the train safely and to enforce respect of this<br />
information”.<br />
Thus the core hazard for the reference architecture is defined<br />
as: “Exceedance of the safe speed / distance as advised to ETCS”.<br />
The maximum rate of occurrence for the core hazard, which is<br />
“derived from consideration of the consequences that an<br />
occurrence of the ETCS core hazard would have on a single<br />
passenger travelling on a train for 1 hour”, is required to be:<br />
“2 × 10 -9 per hour per train”.<br />
This is the maximum Tolerable Hazard Rate (THR) for ETCS<br />
and should be interpreted as the rate per hour for a typical<br />
passenger journey. It is “inclusive of both random equipment<br />
failures and any systematic failures that could be introduced as a<br />
result of the design process”.<br />
However, “failures due to operators (e.g., Driver, signalman,<br />
maintenance staff) and operational rules are not included in this<br />
core hazard or THR”.<br />
Given these caveats, it is clear that the THR is solely<br />
concerned <strong>with</strong> the technical safety of ETCS, and does not<br />
represent the level of operational safety that can be achieved in<br />
practice <strong>with</strong> ETCS. Moreover, it does not take into account the<br />
effect of deliberate attacks on the security of the system.<br />
Fault Tree<br />
Part 1 of the ERTMS Safety Analysis presents a generic functional<br />
fault tree for ETCS based on the failure modes of the ETCS<br />
macro functions, which are derived from the SRS and arranged in<br />
a hierarchy leading up to the core-level hazard.<br />
“The objective of producing the generic functional fault tree<br />
is to provide a system-wide view of functional interactions so that<br />
the migration of base events that have been identified as being<br />
potentially catastrophic can be analysed. The base events were<br />
identified by the FMEA analyses of the mandatory interfaces.”<br />
The fault tree “provides full traceability to the set of system<br />
macro functions as defined in the SRS, whether or not the failure<br />
leads to a catastrophic event”. Thus the fault trees are neutral<br />
<strong>with</strong> respect to the underlying causes of the failure, and are<br />
equally valid for a safety or security analysis.<br />
The ETCS system function splits naturally into two parts, and<br />
this is reflected in the structure of the fault tree:<br />
NOT FOR RE-PRINTING<br />
©<br />
The information function keeps the driver informed of the<br />
speed and distance limits that he must observe in order to<br />
maintain safety;<br />
The enforcement function protects the train from breaching<br />
a safe speed and distance envelope, by intervening <strong>with</strong> a<br />
request for a pre-emptive application of the brake.<br />
Because of the need to keep both the display and the supervision<br />
parameters consistent, there are some common mode<br />
issues in the system:<br />
“if the information provided to the train carried system is<br />
incorrect in terms of a safe speed and distance, then the driver<br />
will be shown the wrong targets. If he drives to these incorrect<br />
targets he will be allowed to do so <strong>with</strong>out being protected from<br />
making an unsafe move by the ETCS supervision and intervention<br />
functions.”<br />
Moreover, it is important that the ETCS is supplied <strong>with</strong><br />
correct train data, since otherwise the calculation of the Most<br />
Restrictive Speed Profile (MRSP) and the braking algorithm<br />
calculation will be incorrect:<br />
“There is nothing that ETCS can do if a driver confidently<br />
enters and acknowledges erroneous data. Thus rigorous checks<br />
outside ETCS will be essential, particularly if data is modified<br />
during a journey or under emergency conditions where an<br />
independent check may be difficult to initiate.”<br />
Other sources of common mode errors include the incorrect<br />
calculation of speed and distance, and mistakes in the placement<br />
of balises or the information supplied to the system about the<br />
track topography.<br />
Fault Tree Analysis<br />
Part 2 of the ERTMS Safety Analysis contains an analysis of the<br />
fault trees from a safety perspective. It enumerates the various<br />
failure modes that have been identified, considers their impact<br />
and criticality on the various ETCS functions in different<br />
operating modes, and suggests possible mitigating conditions.<br />
Although this analysis is from a safety perspective, much of it is<br />
still relevant from a security perspective because the failure<br />
modes and consequences are the same, regardless of whether<br />
the failure is accidental or malicious.<br />
Figure 2, which is taken from Section 8 of Part 2 of Ref. 4,<br />
provides a useful overview of the failure modes and their impact<br />
on the different components of the ERTMS/ETCS reference<br />
architecture.<br />
Many of the failure modes are internal to the on-board ETCS<br />
system and are therefore less relevant to a security analysis, as<br />
noted previously. For example, there are 34 kernel-level failure<br />
events, which would be triggered by faults in the ETCS<br />
Figure 2: Failure modes<br />
6<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong>
implementation itself. Although it might be possible for an<br />
attacker to exploit such design faults, this would need to be<br />
determined as part of the security assessment of an actual ETCS<br />
implementation and such failures are therefore out of scope for<br />
an analysis of the security implications of the ERTMS/ETCS<br />
specifications.<br />
However, failure events at the edge of the reference<br />
architecture, particularly those that relate to transmission of<br />
information and commands, or the provision of external data, are<br />
more obvious attack vectors that could compromise the security<br />
implications of ERTMS and therefore need to be adequately<br />
protected.<br />
ENG Events<br />
The first category of such events is the ENG events, which relate<br />
to “engineering data processing and installation procedures”<br />
and are considered to be outside the scope of the safety<br />
analysis. However, this does not consider the possibility of<br />
deliberate sabotage of the trackside data, for example, by<br />
repositioning the balises (ENG-1a). Providing false radio data<br />
(ENG-1b) for transmission by the RBCs would be more tricky, but<br />
might be possible via a proprietary operational interface to the<br />
RBCs that was outside the scope of the ERTMS/ETCS<br />
specifications. Note that this failure mode is distinct from the<br />
various failure modes that can occur during radio transmission<br />
(TRANS-RADIO-X).<br />
EXT events<br />
The second category of such events is the EXT events, which<br />
relate to external systems outside the scope of ETCS. EXT-1<br />
relates to a failure of the interlocking to provide correct route<br />
data, EXT-2 is another failure of engineering data processing,<br />
and EXT-3 is a failure to send an emergency message when<br />
conditions demand it. Again, it might be possible for an attacker<br />
to trigger some of these events by sabotaging the trackside<br />
equipment or exploiting vulnerabilities in proprietary interfaces<br />
to this equipment.<br />
DRV Events<br />
The third category of events is the DRV events, which relate to<br />
driver errors. Clearly, the driver is a trusted component of the<br />
system, and therefore a potential vulnerability that could be<br />
exploited by an attacker. Five driver-related failures are<br />
identified, some of which are classified as safety-related rather<br />
than safety-critical, but in order to cause a system-level failure it<br />
would be necessary for the driver to disable or mislead the<br />
supervisory function of the ETCS by entering false data.<br />
NOT FOR RE-PRINTING<br />
TRANS Events<br />
©<br />
The fourth category of events is the TRANS events, which relate<br />
to various kinds of transmission errors in either the balise-train air<br />
gap interface, or the RBC-train or RBC-RBC radio interface. The<br />
balises are designed to operate in a hostile physical environment<br />
and telegrams are encoded using a robust encoding scheme,<br />
<strong>with</strong> further levels of protection provided by balise linking at the<br />
application level.<br />
Because of the physical constraints, it would be very difficult<br />
for an attacker to trigger a TRANS-BALISE event – it is much<br />
easier to insert a malicious unlinked balise or move a linked<br />
balise, which would correspond to an ENG-1 failure event.<br />
In contrast, the various TRANS-RADIO events, which divide<br />
into trackside and train-track transmissions, are protected by the<br />
safety layer of the Euroradio protocol and are therefore<br />
dependent on the integrity of the underlying key management<br />
and crypto protocols, which might be easier to attack.<br />
Furthermore, by jamming the GSM-R radio signal, it would be<br />
possible to cause a denial of service attack, which is considered<br />
to be a RAM issue rather than a safety issue and has therefore<br />
been excluded from the safety analysis.<br />
TI and MMI Events<br />
Finally, the TI events and MMI events relate to failures of the<br />
train interface (braking functions) or driver console. Although it<br />
might be possible for an attacker to sabotage these interfaces<br />
on a particular train, it would require physical access to the train<br />
and therefore the attack cannot be performed remotely and<br />
does not scale (unless the design and manufacturing process of a<br />
widely deployed ERTMS system can be sabotaged or<br />
compromised in some way).<br />
Apportioning the tolerable hazard rate<br />
Part 3 of the ERTMS Safety Analysis is concerned <strong>with</strong><br />
apportioning the approved Tolerable Hazard Rate for technical<br />
failures of ETCS (THR ETCS ) to the various components of the<br />
reference architecture. The apportionment is made <strong>with</strong> respect<br />
to a standard mission profile, and is used to derive a set of safety<br />
requirements for interoperability. Thus, Part 3 is less relevant<br />
from a security perspective, particularly since the analysis is<br />
solely concerned <strong>with</strong> the technical safety of ETCS and does not<br />
include operational or security issues.<br />
Nevertheless, Part 3 contains several points of interest. For<br />
example, given the standard mission profile and a plausible set<br />
of assumptions about security threats, it might be possible to<br />
calculate a more realistic hazard rate, or at least expose the<br />
sensitivity of the safety analysis to security assumptions.<br />
Also, some of the assumptions that underpin the analysis are<br />
worthy of further consideration. Section 6.2 deals <strong>with</strong><br />
transmission events, <strong>with</strong> section 6.2.2 dealing <strong>with</strong> the threat<br />
posed by masquerade messages. According to paragraphs<br />
6.2.2.1 and 6.2.2.2:<br />
“The quantitative safety targets derived in this document are<br />
valid for errors in the communication channels originated by<br />
random events (e.g., corruption due to electromagnetic<br />
interference, abnormal delays or repetitions in the non-trusted<br />
communication system).<br />
“Masqueraded messages, originated by intentional attacks to<br />
the radio transmission system, must be treated separately on the<br />
basis of qualitative considerations, because the rate of malicious<br />
attacks can not be estimated. The protection offered by the<br />
cryptographic safety code defined in the Euroradio specifications<br />
may be considered sufficient provided the organisation<br />
responsible for system operation can demonstrate the<br />
appropriateness of measures to ensure the confidentiality of the<br />
keys.”<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong> 7
MARCH TECHNICAL PAPER<br />
In other words, the operational security of the key management<br />
procedures underpins the security of the Euroradio protocol, and<br />
therefore merits careful analysis. Unfortunately, this aspect of<br />
the ERTMS/ETCS specifications is still at the informative stage<br />
and is the subject of some controversy <strong>with</strong> respect to where<br />
responsibility for key management lies. However, according to<br />
the safety analysis here, compromising key management could<br />
compromise the safety of ERTMS.<br />
Similarly, Section 9.3.4 deals <strong>with</strong> the transmission of<br />
Emergency Messages by radio and argues that ensuring the<br />
integrity of such messages is outside the scope of ETCS, but that<br />
the use of the Emergency Message Service should not detract<br />
from the technical safety of the system. In particular, paragraph<br />
9.3.4.2 notes that “[…] the Emergency Message shall use the<br />
high priority channel. Therefore it is not protected <strong>with</strong> the same<br />
safety features as the normal priority channel against corruption<br />
and / or deletion. The ETCS Emergency function is designed for<br />
the shortest possible response time, not for high integrity.”<br />
Whilst this might be appropriate from a safety perspective,<br />
the lack of integrity provides an opportunity for an attacker, who<br />
could abuse the emergency message facility to cause a denial of<br />
service attack.<br />
Finally, in the light of the concerns raised about the security<br />
of unlinked balises, it is interesting to note the following<br />
observation in section 10.2.1 of the conclusions:<br />
“[…] placing total reliance on the detection of un-linked<br />
balises led to requirements on the failure rate for an information<br />
point that is not feasible. This resulted in the requirement for the<br />
use of two separate balise groups each <strong>with</strong> a minimum of two<br />
balises. This requirement eased the target failure rates on both<br />
the onboard and trackside to figures that are feasible.”<br />
Unfortunately, the use of paired balises only protects against<br />
accidental failures of balises, and not against deliberate attacks.<br />
Moreover, the safety analysis recognizes that the system is<br />
particularly vulnerable to TRANS-BALISE events associated <strong>with</strong><br />
unlinked balises, particularly insertion events, which could be<br />
simulated by an attacker placing unlinked balises at strategic<br />
locations.<br />
NOT FOR RE-PRINTING<br />
©<br />
DISCUSSION<br />
Safety and security are both forms of dependability and use<br />
similar techniques to assess the impact of possible failure modes<br />
on the overall behaviour of a system. Thus, it is not surprising<br />
that a security analysis and a safety analysis of ERTMS identify<br />
similar points of vulnerability in the system. Where the two<br />
approaches differ is in their assumptions about the likelihood of<br />
these failure modes. In general, a safety assessment assumes<br />
that failures are accidental rather than malicious, which makes it<br />
easier to estimate the probability of a failure, whereas a security<br />
analysis tends to assume a worst-case scenario in which all<br />
failures are possible.<br />
Nevertheless, safe systems need to be secure; if they are not<br />
secure, then they are not safe. A safety analysis that does not<br />
consider hazards that could be caused by underlying security<br />
vulnerabilities is deficient.<br />
In practice there may be conflicts between security<br />
requirements and safety requirements. For example, in an<br />
emergency situation, a timely response may be more important<br />
than a secure response. Moreover, safety concerns are rather<br />
different from security concerns: confidentiality is not usually a<br />
safety concern, neither is availability. Safety is primarily concerned<br />
<strong>with</strong> integrity – a system should not do something that is<br />
damaging to its environment, and therefore in some circumstances,<br />
doing nothing is the safest option. In contrast, security is traditionally<br />
concerned <strong>with</strong> confidentiality, integrity and availability.<br />
A failure of confidentiality would not be considered a safety<br />
concern, but would definitely be a security concern. Similarly,<br />
fail-safe behaviour is important from a safety perspective but<br />
conflicts <strong>with</strong> the security requirement to maintain availability.<br />
CONCLUSIONS<br />
Safety is always paramount in railway systems, and ERTMS is<br />
designed to be a safe system. The general philosophy is ‘if in<br />
doubt, stop the train’, which means that it is very difficult for an<br />
attacker to engineer a train accident. However, it is possible for<br />
an attacker to exploit the ‘fail safe’ behaviour of ERTMS, and<br />
create a situation that causes a train to halt. Thus, denial of<br />
service attacks are possible, and could be launched at a time and<br />
place of the attacker’s choosing, perhaps designed to cause<br />
maximum disruption or passenger discomfort (e.g., causing a<br />
train to halt in a tunnel). Causing an accident is more difficult<br />
but not impossible; however, it is important to remember that<br />
ERTMS does not drive the train, and it is therefore the driver<br />
who is ultimately responsible for the safety of the train.<br />
Subsequent work has explored these issues further, including<br />
the identification of specific vulnerabilities, and our results have<br />
been presented to representatives of the UK rail industry and the<br />
European Railway Agency (ERA). Some of the vulnerabilities we<br />
have identified depend very much on the specific details of the<br />
national implementation of ERTMS and GSM-R. Moreover, some<br />
of the most critical parts of an ERTMS implementation (e.g., the<br />
interface between the control centre and the RBCs) are outside<br />
the scope of the ERTMS/ETCS specifications, which are only<br />
concerned <strong>with</strong> interoperability and do not address<br />
implementation issues <strong>with</strong>in a national implementation. Thus,<br />
there is a need to extend the scope of our security review to<br />
include the whole of the national railway infrastructure. More<br />
generally, it is important to ensure that security issues are taken<br />
into account when preparing safety cases, and further work in<br />
this area is planned.<br />
ACKNOWLEDGEMENTS<br />
This work was commissioned by CPNI on behalf of the UK rail<br />
industry and was performed by the Centre for Software<br />
Reliability, City University London. The authors would like to<br />
acknowledge the contributions of Dr Ilir Gashi and Richard<br />
Bloomfield.<br />
REFERENCES<br />
Ref 1. UNISIG SUBSET-026, System Requirement Specification,<br />
Version 2.3.0<br />
Ref 2. UNISIG SUBSET-037, Euroradio FIS, Version 2.3.0<br />
Ref 3. UNISIG SUBSET-038, Off-line Key Management FIS,<br />
Version 2.1.9<br />
Ref 4. UNISIG SUBSET 088, ETCS Application Levels 1 & 2 -<br />
Safety Analysis, Version 2.3.0<br />
(See www.era.europa.eu)<br />
8<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong>
WEN ZHOU<br />
Wen Zhou: What went wrong?<br />
By George Nikandros, F<strong>IRSE</strong><br />
(This article was originally written for the newsletter of the Australian Safety Critical Systems Association and<br />
has been recently updated by the Author. If any member has further information perhaps they could let the<br />
<strong>IRSE</strong> NEWS know and it will be published for all to read)<br />
THE ACCIDENT<br />
On 22 July 2011 at about 20:37 two high speed trains collided<br />
on a viaduct near Wen Zhou, resulting in 40 deaths and more<br />
than 200 injuries, raising concerns about the safety of high<br />
speed rail in China (Ref 1). In December 2011, an official<br />
report (in Mandarin Chinese) was released; however the cause<br />
of the accident still remains a mystery. The report however<br />
supports the media statements made by Chinese Government<br />
and Railways officials since the accident.<br />
From these media statements, the Wen Zhou accident was<br />
caused by a failure of a safety-critical system; at least that<br />
seems to be the consensus. According to a South China<br />
Morning Post article by Stephen Chen, the December 20<strong>12</strong><br />
report about on the investigation into the accident raises<br />
unnerving questions about the safety of the mainland’s highspeed<br />
rail network <strong>with</strong>out supplying any answers. According<br />
to the article a serious software bug in the main computer of<br />
the train control system at a station was pivotal in the accident,<br />
although details are as yet unknown. Since the accident there<br />
has been much speculation even conjecture as to why and how<br />
the signalling system failed so catastrophically. The on-line<br />
Wall Street Journal (3 October 2011) (Ref 2) even suggests that<br />
protection of intellectual property (copyright) was a contributing<br />
factor.<br />
According to a Railway Gazette article (Ref 3), the recentlyappointed<br />
head of the Shanghai Railway Bureau, An Lusheng,<br />
appearing before the independent investigation panel<br />
established by the State Council, said that ‘design flaws’ in the<br />
signalling on the Ningbo – Wen Zhou high speed line led to<br />
the fatal rear-end collision near Wen Zhou on July 22. He<br />
added that having been struck by lightning, the signal system<br />
at Wenzhou South station failed to turn a Green light to Red.<br />
On the same day, the Beijing National Railway Research &<br />
Design Institute of Signal & Communication issued an apology<br />
for the accident.<br />
The railway between Ningbo and Wenzhou South is<br />
equipped <strong>with</strong> lineside signals overlaid <strong>with</strong> CTCS-2 (Chinese<br />
Train Control System) to provide automatic train protection<br />
which apparently has a similar functionality to the ETCS<br />
(European Train Control System) Level 1, using balises to<br />
provide intermittent updates to the on-train equipment. The<br />
line is designed for mixed traffic operation <strong>with</strong> a maximum<br />
speed of 250 km/h.<br />
A link to a timeline of events from the Wen Zhou Control<br />
Centre published by a Chinese newspaper in Mandarin<br />
Chinese was posted to the Safety Critical Mailing List by Oleg<br />
Lisagor on 28 July, 2011. The timeline was considered to be<br />
from a trustworthy source. An interpretation of the translated<br />
timeline of events follows. Figure 2 is provided to aid<br />
understanding:<br />
NOT FOR RE-PRINTING<br />
©<br />
Figure 1: Chinese rescue workers by the wreckage of train cars in Wen Zhou<br />
7:34 pm Wen Zhou south advised that train D32<strong>12</strong> on the 4th road<br />
whilst approaching the starter signal at Proceed, had<br />
passed the station starter signal at Stop. (The signal<br />
appears to have changed to stop as the train D32<strong>12</strong><br />
approached it.) Control (Shanghai Control Centre) then<br />
asked the driver if the train was moving. Upon confirmation<br />
from the driver that the train was not moving,<br />
Control cancelled the re-clearing request of this signal.<br />
7:36 pm Because Wen Zhou south 4th road station starter signal<br />
has no way of clearing, Control arranged for Wen Zhou<br />
south station to be transferred to emergency control.<br />
7:39 pm The Yong Jia to Wen Zhou South down line section, three<br />
approach track sections to Wen Zhou south station<br />
showed up as occupied / failed as a result of a lightning<br />
strike. Civil/Signal maintenance staff and traction<br />
overhead maintenance staff were notified.<br />
7:44 pm Control (Shanghai) received the following report from Wen<br />
Zhou south station: Station communication centre screen<br />
showed that three consecutive approach sections in the<br />
down direction were failed/occupied, station (Control)<br />
CTC screen didn’t show anything. After train D32<strong>12</strong><br />
departed the 4th road, control arranged for normal station<br />
control to be returned to Wen Zhou South station.<br />
7:45 pm Wen Zhou South station reported to Yong Jia and Ou Hai<br />
station that the approaching and departing sections were<br />
shown as occupied.<br />
7:51 pm Train D3115 arrives at Yong Jia station.<br />
7:53 pm Control (Shanghai) arranged for Wen Zhou south station to<br />
transfer to emergency control.<br />
7:54 pm Yong Jia station was transferred to emergency control.<br />
7:55 pm Control (Shanghai) arranged for Ou Hai to transfer to<br />
emergency control. Wen Zhou south station transferred to<br />
emergency control.<br />
8:06 pm The officers in charge of Yong Jia station made a special<br />
call to the driver of D301 advising Yong Jia station is under<br />
emergency control.<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong> 9
WEN ZHOU<br />
8:<strong>12</strong> pm Train D301 arrives at Yong Jia station.<br />
8:14 pm Control (Shanghai) arranged for train D3115 to<br />
depart Yong Jia station, informing the driver to<br />
proceed <strong>with</strong> vigilance On-Sight mode at<br />
20 km/h upon encountering a Red signal<br />
(aspect) <strong>with</strong>in the section.<br />
8:15 pm Train D3115 departs Yong Jia station.<br />
8:20 pm Wen Zhou south station reported that four<br />
approach down line (track) sections had failed<br />
(they showed up as flashing on the screen), but<br />
the section going to Ou Hai was clear.<br />
8:24 pm Train D301 departs Yong Jia station.<br />
8:25 pm Train D3115 stopped at three track sections<br />
from Wen Zhou, and then proceeded on<br />
On-Sight mode.<br />
8:26 pm Control (Shanghai) contacted Wen Zhou south<br />
station. (Wen Zhou south) station reports train<br />
D3115 was approaching and was three signal<br />
sections away. CTC (Control) system showed<br />
that the occupied sections had already cleared.<br />
Because train D3115 train spent a long time in<br />
the section, Southern Wen Zhou station<br />
contacted the driver of D3115 train. The driver<br />
answered saying that the signal aspects <strong>with</strong>in<br />
the section were not stable. The officers in<br />
charge of Wen Zhou south station reported<br />
this to the officers in charge of Yong Jia<br />
station.<br />
8:?? pm When D301 was <strong>with</strong>in 6-7 signal sections away<br />
from D3115, Wen Zhou South station made a<br />
special call to the driver of D301 advising the<br />
driver that “Train D3115 is <strong>with</strong>in this section,<br />
proceed <strong>with</strong> caution.” The driver of D301<br />
acknowledged this in response. (The precise<br />
time is unknown; however it must some time<br />
after the departure of train D301from Yong Jia.<br />
i.e. after 8:24 pm.)<br />
8:31 pm Driver of train D3115 reported (to Shanghai<br />
Control) that passengers have pressed the<br />
emergency stop button and the train<br />
pantograph has retracted.<br />
8:37 pm Control (Shanghai) arranged for Wen Zhou<br />
South station to contact the driver of D301 to<br />
apply braking<br />
8:39 pm Control (Shanghai) received the following<br />
report from Wen Zhou south station: The train<br />
driver for D3115 reported that the rear<br />
carriages of the train had derailed, and there is<br />
half a section of carriage hanging off the<br />
bridge.<br />
Train D301 and train D3115 collided head to tail<br />
between Yong Jia (@570k680m) and Wen Zhou South<br />
(@588k863m) close to 585k700m, causing train D3115<br />
carriages 13, 14, 15, 16 to derail, and train D301 carriages<br />
1 to 4 to derail (of which carriages 1 and 2 fell off the<br />
bridge, the bridge being approximately 15 metres in the<br />
air).<br />
NOT FOR RE-PRINTING<br />
©<br />
Figure 2: Schematic showing location of time line events<br />
WHY DID THE ACCIDENT HAPPEN?<br />
Until the precise cause is identified, one can only speculate as to how the<br />
accident happened. However the timeline of events provides some clues.<br />
From the extent of physical damage to the trains, it is reasonable to<br />
conclude that this was a high speed collision. So what caused the driver<br />
of train D301 to travel at such a high speed knowing that train D3115<br />
being ahead and travelling at slow speed and that there was signalling<br />
problems at Wen Zhou?<br />
The most plausible explanation is that the driver of train D301 must<br />
have got an “all clear” signal despite train D3115 being ahead and<br />
travelling at 20km/h. This can only arise if the signalling system fails in an<br />
unsafe way. A Ministry of Railways official supposedly said (Ref 4) that a<br />
lightning strike damaged a fuse which caused the lights in the lineside<br />
signals to go out; thus there were no signals at RED for the driver of train<br />
D301 to see.<br />
One event that does not seem plausible is the application of the<br />
emergency brake by a passenger on train D3115, particularly as the train<br />
had not long stopped when it encountered a signal at RED and was<br />
10<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong>
INDUSTRY NEWS<br />
travelling slowly (20 km/h), assuming that the driver was following the<br />
instructions from Train Control. Also, given that the pantograph retracted<br />
strongly suggests that this was a system response to a signalling violation<br />
i.e. the train passed a signal at RED or some other system failure.<br />
The Red signal encountered by train D3115 aligns <strong>with</strong> the indications of<br />
failed track sections to the station staff at Wen Zhou and is evidence that<br />
the signalling system was failed in the usual safe mode. The report from the<br />
driver of train D3115 that the “signal aspects were not stable”, suggests<br />
that the maintenance staff were on-site attempting repair; they were<br />
notified at 7:39 pm, well before train D3115 departed Yong Jia for Wen Zhou<br />
at 8:15 pm.<br />
It appears that the part of the signalling system which creates and issues<br />
the movement authority for train D301 contained a state of the track ahead<br />
which was not consistent <strong>with</strong> state of the track at the local signalling system<br />
at Wen Zhou.<br />
Without knowledge of the particular signalling system technology or its<br />
architecture it is not possible to draw any conclusions as to how such an<br />
inconsistency eventuated. It may be that the data might not have been<br />
refreshed due to equipment damage cased by lightning; there was a storm<br />
at the time.<br />
Hopefully the investigation will identify the cause and that cause(s) be<br />
made public. There is no doubt that there would be important lessons for<br />
the rail industry. It would be a shame if pride and reputation prevents<br />
learning from this accident.<br />
According to a South China Morning Post article, the December 2011<br />
report on the accident investigation adds to the speculation that protection<br />
of intellectual property may have been a contributing factor.<br />
The supplier of the on-board Automatic Train Protection system was<br />
Hollysys Automation Technologies Ltd, a Beijing based company.<br />
According to the on-line Wall Street Journal, the systems supplied by<br />
Hollysys were branded as proprietary to Hollysys and contained tailor-made<br />
components from Hitachi (Japan).<br />
Apparently, Hitachi concealed the inner workings of the tailor-made<br />
components fearing loss of their intellectual property, so as to make it<br />
harder to clone. Whilst one can understand the action to conceal the inner<br />
workings to protect their intellectual property, Hitachi’s view that Hollysys<br />
would not integrate the equipment into a broader safety-signalling system<br />
<strong>with</strong>out Hitachi’s intimate knowledge and know-how appears to have been<br />
a major miscalculation.<br />
It is well known that China does not abide by or support international<br />
laws <strong>with</strong> respect to copyright and intellectual property.<br />
This however raises ethical issues. In many other countries there are<br />
laws which mandate the disclosure of information on the safe use of your<br />
goods; not only for their intended use, but also <strong>with</strong> respect to foreseeable<br />
misuse. Purposely hiding information, particularly relating to something that<br />
may not be obvious, that could prevent harm, would be a contravention of<br />
these laws. It would also contravene the ethics of most professional bodies.<br />
Hopefully this article will prompt further <strong>IRSE</strong> NEWS contributions on<br />
this topic.<br />
NOT FOR RE-PRINTING<br />
©<br />
REFERENCES<br />
Ref 1: http://china.org.cn/china/2011-09/16/content_23429796.htm<br />
Ref 2: http://online.wsj.com/article/<br />
SB10001424053111904353504576568983658561372.html<br />
Ref 3: http://www.railwaygazette.com/nc/news/single-view/view/signalfailure-suspected-in-wenzhou-crash.html<br />
Ref 4: http://blog.english.caixin.com/article/361/<br />
Turkish State Railways ERTMS<br />
A joint venture of Invensys Rail and Turkish civil<br />
engineering company Fermak has been awarded a<br />
76 million project from Turkish State Railways (TCDD)<br />
to install advanced European Rail Traffic Management<br />
System (ERTMS) signalling and communications on the<br />
310 km Bandirma-Menemen railway - the main rail<br />
link between the <strong>Mar</strong>maray and Mediterranean seas.<br />
Invensys Rail’s share of the award, worth 59m,<br />
will see the company design, supply, install, test and<br />
commission its industry leading FUTUR ERTMS<br />
systems both onboard trains and on the lineside.<br />
The whole route will run under the sophisticated and<br />
proven ERTMS Level 2 regime. Invensys Rail will also<br />
install automatic train stop equipment, WESTRACE<br />
electronic interlockings, FS3000 jointless track<br />
circuits, level crossing safety systems, GSM-R voice<br />
and data communications, and a Central Traffic<br />
Control Centre in Balikesir.<br />
Last November, Invensys Rail signed a contract to<br />
supply the signalling and communications for the<br />
high-profile <strong>Mar</strong>maray link, which will see a new<br />
undersea tunnel link both halves of Istanbul by rail.<br />
This link will see Invensys Rail deploy both its ERTMS<br />
system for conventional rail and its Communications<br />
Based Train Control technology for commuter trains<br />
on the same railway - the first time this has been<br />
done anywhere in the world.<br />
Croatia commissions ERTMS<br />
The first railway line in Croatia to be equipped <strong>with</strong><br />
ERTMS / ETCS technology has begun operations.<br />
The Bombardier INTERFLO 250 ERTMS / ETCS<br />
Level 1 system is now operating on the upgraded<br />
33.5 km section of the Pan European Corridor X<br />
between Austria and Greece.<br />
The signalling system was delivered by a consortium<br />
of Bombardier and Site on the 33.5 km section<br />
of the Vinkovci - Tovarnik line to the Serbian border.<br />
As part of the project the company had provided a<br />
next generation Lock 950 computer-based interlocking<br />
system and wayside equipment, certification<br />
of the system allowing trains to run at a speed up to<br />
160 km/h (100 mph).<br />
Monorail System for Delhi<br />
The Delhi Government in India has given an inprinciple<br />
approval for the construction of a 10.8 km<br />
elevated monorail line forming a link between the<br />
Shastri Park Metro station and Trilokpuri through<br />
Laxmi Nagar in east Delhi.<br />
The proposed monorail will be straddle-type and<br />
run on an elevated line built on 9 metre high pillars.<br />
The system is expected to be functional by 2017.<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong> 11
<strong>IRSE</strong> CONVENTION - PART 2<br />
Some individual views of the <strong>IRSE</strong> International Convention to Singapore and Kuala Lumpur<br />
<strong>IRSE</strong> International Convention: Tuesday 11 October 2011<br />
By Trevor Foulkes<br />
Photos: Trevor Foulkes and Ian James Allison<br />
On the weekend immediately prior to the convention, the final<br />
section of the Singapore Circle Line came into operation. As a<br />
result, I read in The Straits Times, that Mr Packiam Malayamanar<br />
gets an additional thirty minutes to enjoy his breakfast. This line<br />
was bought into use and is run by SMRT and they were the<br />
focus of the second day of the convention.<br />
The day started <strong>with</strong> a presentation in the SMRT headquarters<br />
lecture hall by Frank Wong, senior vice president (development)<br />
in which he explained that his company was also helping <strong>with</strong><br />
the development and specifications for mass transit rail systems<br />
across the region. He explained in particular that to make a<br />
profit you need to exploit the stations and communications<br />
systems. He referred to the stations as a life style hub and when<br />
you go to them then you see what he means as the shopping<br />
facilities are integrated into the stations.<br />
Pierre Damien Joudain explained that the Circle line control<br />
system is basically the same as that used on the North-East line<br />
in Singapore but that the length of the trains and the different<br />
traction types had to be included in the design process. The<br />
aim is have a system which is 99.9% available. To demonstrate<br />
this, a complete test system had been established in France to<br />
enable all aspects to be checked. In addition he stressed that<br />
keeping configuration under close management and obtaining<br />
input from the staff that operate the system had made the<br />
introduction a success. During the questions it was explained<br />
that the signalling system had been designed <strong>with</strong> extra<br />
capacity so that as the line got busier, additional trains could be<br />
introduced to meet the demand.<br />
Charles Page then provided a more technical description of<br />
how the control systems work and what is planned for the new<br />
Downtown line, which is due for completion early in 2013 <strong>with</strong><br />
most of the civil works being undertaken currently. He<br />
explained that the Sirius on-board computer is connected to the<br />
Westrace interlocking using a Safetrans radio link working in the<br />
unlicensed 2.4 GHz band. He explained how technical<br />
improvements had been made to the radio system to reduce<br />
the chances of interference and blocking from other users of the<br />
band. In addition, he explained that the system had been<br />
developed to include a coded track fall back system. This would<br />
allow trains to restart and run automatically should the<br />
Computer Based Train Control (CBTC) not be available. The<br />
system was primarily to allow trains to, at least, travel to a<br />
station where staff could then access the train. In normal use,<br />
however, the train determines its position from transponders<br />
placed about every 400 m along the line and using odometry<br />
and doppler systems. It then reports its position as it travels<br />
along the track and receives authority to proceed when it is safe<br />
to do so. The system had been optimised to make best use of<br />
the radio system. A formal acceptance strategy has been defined<br />
and test track testing is being undertaken. During Questions it<br />
was clarified that one Westrace interlocking was used per<br />
NOT FOR RE-PRINTING<br />
©<br />
station to reduce the effect of loss to a small area.<br />
We then had presentation on platform door systems by<br />
Ramadwammy Muthuramen in which I learnt that they are much<br />
more complicated that I would have expected <strong>with</strong> data communications<br />
being established <strong>with</strong> the train to exchange information<br />
on door configuration, door failures and to synchronize opening<br />
and closing. It was explained that platform doors were originally<br />
fitted to allow the air conditioned environment on the platforms to<br />
be maintained but they also has secondary advantages for safety<br />
and to show passengers were to stand to enter the train. During<br />
the convention however a number of members commented on the<br />
slowness of opening and closing doors on the trains and how this<br />
lead to longer dwell times at the stations. Perhaps this is an area<br />
which could benefit from more work.<br />
The group then travelled to the impressive underground SMRT<br />
depot at Kim Chuan. The members were split into different<br />
groups to enable us to see many aspects of the depot. These<br />
included an impressive three-story high automatic stock picking<br />
system which dealt <strong>with</strong> spares for the trains and the electrical<br />
plant on stations.<br />
The train inspection facility, <strong>with</strong> safety harnesses for staff<br />
working on the roof, gave the group a chance to examine the<br />
driver’s position (which is not normally used in service) and to see<br />
the train mounted parts of the train control system. I also learnt<br />
how the emergency access door is opened, that the control and<br />
radio units are mounted under the main frame and require their<br />
own fans to keep temperatures acceptable and that a wave guide<br />
is used to provide radio connectivity for the on board surveillance<br />
cameras and signalling.<br />
We visited the control centre equipment room where I saw<br />
SCADA equipment, Synchronous Digital Hierarchy transmission<br />
equipment and the main distribution frame, as well as the main<br />
control room which included a full length display of the route<br />
showing traction equipment status as well as train position and<br />
signal status. It was initially concerning to see two trains become<br />
a single red section but this shows the problem of trying to display<br />
moving block position on a traditional style panel. The display<br />
also showed the status of the platform doors and was surrounded<br />
by many CCTV monitors to allow incidents to be monitored.<br />
The depot control room was like having your very own full size<br />
train set! As all the trains are automatic the operator can move<br />
them around the depot under his direct control and monitor them<br />
on CCTV. A facility had been provided to enable sections of the<br />
depot to be locked out to allow safe access by staff.<br />
I would like to thank SMRT for making their facilities available<br />
and giving us a chance to see what happens behind the scenes to<br />
provide a train system which provides quick and reliable service to<br />
the people of Singapore.<br />
In the evening some colleagues and I went on the night safari<br />
at the zoo during which we found an interlocking failure in the<br />
flying squirrel exhibit!<br />
<strong>12</strong><br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong>
1<br />
2<br />
4<br />
5<br />
3<br />
1. The impressive underground SMRT depot at Kim Chuan<br />
2. The driver’s position, not normally used in service<br />
3. The SMRT Control Centre<br />
4. The SMRT Control Centre<br />
5. The group admire the three-story high automatic stock picking system<br />
<strong>IRSE</strong> International Convention: Wednesday <strong>12</strong> October 2011<br />
By Ian R Bridges<br />
Photos: Ian James Allison and Keith Walter<br />
NOT FOR RE-PRINTING<br />
train was driven by the Sultan of Johar, which ended 79 years of<br />
©<br />
Members and guests made an early start on Wednesday,<br />
checking out of their Singaporean hotels to travel by bus to the<br />
Woodlands Train Checkpoint (WTCP) in the north of the island.<br />
Despite the very heavy traffic on the city bound routes, good<br />
time was made to the checkpoint. Here each person had to take<br />
their luggage through the immigration procedure, passing easily<br />
into Malaysia before waving goodbye to their suitcases in the<br />
hope that they would be re-united later in the day at their<br />
respective hotels in Kuala Lumpur. WTCP now forms the<br />
southern end of the railway to Malaysia and the point at which<br />
the party joined their train to the north for the second part of the<br />
first ever two centre convention.<br />
Following a short wait, the group joined the 08:45 train to<br />
Butterworth, on which they would travel 250 km (156 miles) as<br />
far as Tampin Pulau Sebang, once a junction for the Melaka Line,<br />
dismantled by the Japanese during World War II. After a kind<br />
member of the train crew had wiped the condensation off the<br />
outside of the carriage windows for the passengers, the diesel<br />
hauled train made a fairly prompt departure, leaving Singapore<br />
behind as it crossed the causeway onto the Malaysian mainland<br />
and Johor Bahru Sentral, the first station on the journey.<br />
Prior to mid 2011, passengers heading north from Singapore<br />
would have gone to Tanjong Pagar station (also known as<br />
Keppel Road) railway station. However, the 26 km track bed<br />
south of WTCP closed <strong>with</strong> the departure of the 23:00 train on<br />
the 30 June 2011, having previously served as the southern<br />
terminus of the Keretapi Tanah Melayu Berhad (KTMB – Malayan<br />
Railway Limited) line from Malaysia. To mark the occasion the<br />
passenger and freight operation, interrupted only for a short<br />
period during World War II when the Johor–Singapore Causeway<br />
linking Singapore to Malaysia was partially severed in 1942 to<br />
prevent the Japanese army from invading Singapore.<br />
The closure of the line through the centre of the island<br />
formed part of a land swap and development deal between the<br />
two countries. A rapid transit link is planned to enhance the<br />
remaining railway, which will run between Johor Bahru station in<br />
Malaysia and the Republic Polytechnic in Singapore, opening in<br />
2018.<br />
The line to Kuala Lumpur is single track metre gauge (3 ft 3/8<br />
in) <strong>with</strong> frequent passing loops, stops, twists and turns and much<br />
bouncing around on the way. At the next stop, Kempas Baru,<br />
members temporarily alighted to put their digital photographic<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong> 13
<strong>IRSE</strong> CONVENTION - PART 2<br />
equipment to work, <strong>with</strong> pictures of couplings and bogies being<br />
captured for posterity, before returning to the train for a hearty<br />
breakfast of sandwiches and spring rolls, pasties and some very,<br />
very sweet tea, all served by an attentive catering staff.<br />
Under the control of a very British style of colour light 3-aspect<br />
signalling, the train moved on to the next stop, Kulai, where after<br />
drawing into the station, the train was propelled backwards and<br />
returned to the adjacent platform to allow the passing of a southbound<br />
sleeper train heading for Johor Bahru. The time by now<br />
was around 10:10 and the intercity train had covered around<br />
40 km (25 miles). After here the train picked up speed and<br />
proceeded on its way through massive areas of uncultivated palm<br />
trees and of dense jungle vegetation along <strong>with</strong> swampland<br />
interspersed <strong>with</strong> occasional hamlets, villages and towns, sometimes<br />
<strong>with</strong> a few railway sidings controlled from a ground frame.<br />
Several brightly coloured Buddhist temples were passed, reminiscent<br />
of last year's visit to India, and providing a contrast to the<br />
many brown muddy rivers we crossed over. Some areas of<br />
vegetation have been cleared to grow bananas. Many lineside<br />
poles, part of a previous pole route, were still in-situ, although<br />
the wires were long gone, presumably replaced by a more<br />
modern method of communication.<br />
Containerised cement traffic heading south passed at Kluang,<br />
the next brief stop before continuing through more vegetation<br />
and deep red soil, which is fed by Malaysia's 2340 mm (92 inches)<br />
of annual rainfall. After further stops at Paloh, Labis and Segamat,<br />
the train arrived at Gemas, where the line to the north-east splits<br />
from that heading to the north-west, Kuala Lumpur and Thailand.<br />
On the approach to Gemas, the railway scenery changed dramatically<br />
as a large new railway development was passed. This is to<br />
be the new southern terminus of the Seremban to Gemas double<br />
tracking electrification project, although there are future plans to<br />
extend the line further south all the way to Johor Bahru. The<br />
project, which is being funded by the Malaysian Government, is<br />
costing MYR3.45 billion (£0.69 billion) and will provide 25 kV<br />
electrification throughout the route from Kuala Lumpur, around<br />
179 km. A number of large new bridges and re-construction of a<br />
number of older ones have been completed to provide the trace<br />
of the new 2 track railway. A massive excavation to the south of<br />
the new station will provide the stabling facilities for the new<br />
station. Some of the new track, OHLE masts and registration<br />
arms are already in place along <strong>with</strong> some of the new 3 aspect<br />
signals providing bi-directional running capability.<br />
The train finally arrived in Tampin some 45 minutes behind<br />
schedule, following which the party joined a number of buses for<br />
a short 15 minute drive to A’famosa Resort in the state of Melaka<br />
for an unfortunately hasty but nevertheless enjoyable lunch. The<br />
buses once again loaded, the party departed for the capital of<br />
the state and World Heritage Site of Malacca City, around an<br />
hour away, situated on both sides of the Malacca River near to its<br />
mouth where it enters the Strait of Malacca which separates<br />
Malaysia from its neighbour Indonesia. The party was dropped<br />
off in the historic central area of the city adjacent to the oldest<br />
functioning Protestant church in Malaysia, Christ Church of<br />
Malacca, built in 1753 by the Dutch.<br />
In an effort to burn off the aforementioned lunch most people<br />
climbed the hill to the ruin of St. Paul’s Church, the original of<br />
NOT FOR RE-PRINTING<br />
©<br />
which was built in 1521. It was deconsecrated following the<br />
completion of the Christ Church and it became part of the<br />
fortification of the city <strong>with</strong> only the shell of the building and the<br />
graveyard remaining today. Our final stop in Malacca was on the<br />
western side of the river in the Chinese quarter, where there was<br />
a chance to visit many historic buildings, temples and shops,<br />
including the Cheng Hoon Teng Temple, the oldest Chinese<br />
temple in Malaysia.<br />
To complete a fairly long day of travelling, the party left<br />
Malacca behind to travel the 148 km north to the capital city of<br />
Malaysia, Kuala Lumpur (KL), itself a Federal Territory and<br />
governed directly by the Federal Government of Malaysia, but<br />
completely surrounded by the state of Selangor. The second city<br />
in terms of population (the largest being Subang Jaya), KL has a<br />
population of just over 1.4 million people and covers an area of<br />
243 km 2 (94 square miles) and forms part of the Klang Valley<br />
agglomeration, total population of 7.2 million. With its origins in<br />
the 1850s following tin prospecting, both the Parliament of<br />
Malaysia and the official residence of The King, Istana Negara,<br />
are situated <strong>with</strong>in the city and it forms the cultural, financial and<br />
economic centre of Malaysia. Following arrival in the city,<br />
everybody checked into their respective hotels and settled down<br />
for the remaining part of the evening, re-charging their batteries<br />
ready to undertake technical and cultural visits the following day.<br />
6<br />
9<br />
11<br />
7<br />
6 The statue of St. Francis Xavier<br />
welcomes visitors to the ruined<br />
16th-century Church of St. Paul<br />
7 + 8 The young at heart climb the hill to<br />
visit the ruins<br />
9 The A’Famosa Resort Hotel<br />
10 Four old guns<br />
11 Colourful Transport in Malacca<br />
8<br />
10<br />
14<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong>
<strong>IRSE</strong> International Convention:<br />
The Guest Perspective<br />
By Lynn Burkhardt<br />
Approximately 60 multinational guests and their companions<br />
attended the first two-country <strong>IRSE</strong> convention this previous<br />
October. The first country was the tropical island of Singapore:<br />
an ultra-clean, well-planned, modern city/country, about the size<br />
of the Isle of Wight in the UK. The ceremonies began on Sunday<br />
at the Swissotel, located in the lively Clarke Quay Entertainment<br />
District. The guests signed in and were treated to goodie bags<br />
full of items helpful in a tropical environment: Kleenex, wet wipes<br />
and umbrellas for protection from rain and sun.<br />
Monday morning, the conference-attendees left for their<br />
technical visits and lectures, while the guests, including myself,<br />
boarded buses to explore the nearby sights. First stop was the<br />
Chettiar Sri Thendayuthapani Hindu Temple, dedicated in 1859<br />
to the six-faced god Muruga. Most striking was the 75-foot-high<br />
Gopuram, a monumental tower above the entryway, elaborately<br />
sculptured <strong>with</strong> Hindu deities. As we were leaving, the neardaily<br />
Singapore rain began. Undeterred, we boarded charming<br />
bumboats, small wooden water-taxis, and cruised up the<br />
Singapore River through the historical Colonial district to the<br />
stunning <strong>Mar</strong>ina Bay. The sun returned as we disembarked for<br />
photos of the sights: the majestic Singapore Flyer Ferris wheel,<br />
the Merlion fountain and the <strong>Mar</strong>ina Bay Sands Hotel, composed<br />
of fantastical flower, clamshell and ship-shaped buildings.<br />
Returning to the bus, we enjoyed the hilltop views from<br />
Mount Faber Park <strong>with</strong> a stop for tea at the quaint Danish<br />
Seamen’s Church. Recharged, we headed to the far side of the<br />
bay for a ride on the Singapore Flyer. In our spacious pod,<br />
slowly rotating to the top of the giant wheel, we could see the<br />
vast sprawl of Singapore’s high-rises and the hundreds of ships<br />
waiting in nearby waters to dock in one of the world’s busiest<br />
ports. Those not wanting to brave the giant wheel enjoyed the<br />
shops underneath, including a unique pedicurist that used tanks<br />
of tiny fish that nibble the hard skin from a person’s feet.<br />
The historic Raffle’s Hotel provided an elegant lunch buffet.<br />
Afterwards, we could choose to catch a bus ride back to our<br />
hotel or strike out on our own. A few decided to stay and enjoy<br />
Raffles peaceful verandas, gardens and shops. A must-see was<br />
the famous Longbar, origin of the Singapore Sling. That evening,<br />
we rejoined our companions for dinner at the opulent Fullerton<br />
hotel, the perfect location for watching the sunset on the<br />
Singapore River and the colourful lights of the city. The evening<br />
was complete <strong>with</strong> a romantic boat ride back to the hotel.<br />
Tuesday’s travels began <strong>with</strong> rain as the guests boarded the<br />
Admiral Cheng Ho, a replica of the famous Ming Dynasty<br />
imperial junk boat. We enjoyed cakes, sandwiches and tea in<br />
comfort while touring the port and outlying islands. Back on the<br />
buses, we drove through Little India. The Park Royal Hotel<br />
served us a delightful Dim Sum lunch where the tea master<br />
poured tea in a martial arts style. The skies cleared as we<br />
headed to the National Orchid Garden. Lovely landscaped<br />
NOT FOR RE-PRINTING<br />
©<br />
16<br />
17<br />
18<br />
Singapore<br />
<strong>12</strong>. Clarke Quay<br />
13. The freebie umbrellas<br />
proved very useful<br />
14. Singapore Sky Park<br />
15. Spectacular Flyer<br />
16. The 75-foot high<br />
entrance to the Hindu<br />
Temple<br />
17. Admiral Cheng Ho<br />
18. The Merlion, the Symbol of Singapore<br />
19. The Tea-master demonstrates his skill at the Park Royal Hotel<br />
20. Colourful and irresistible to photographers - the National Orchid Garden<br />
<strong>12</strong><br />
13<br />
14<br />
15<br />
19<br />
20<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong> 15
<strong>IRSE</strong> CONVENTION - PART 2<br />
hillsides boasted an impressive variety of<br />
orchids. The cameras were clicking<br />
furiously here. After an essential stop in the<br />
gift shop, we headed to our hotels for a<br />
free evening <strong>with</strong> our companions.<br />
There were no technical visits early<br />
Wednesday as the entire conference<br />
boarded the train for Malaysia, the second<br />
host country. Travelling through lush green<br />
palm tree plantations, our final destination<br />
would be Kuala Lumpur, known as KL,<br />
Malaysia’s capital. We stopped for a<br />
diversion in Melaka (Malacca), the historical<br />
state of Malaysia. The Resort Afamosa,<br />
where we lunched, was a tropical retreat<br />
<strong>with</strong> gardens, fountains and pools of giant<br />
koi. From there we headed into the historic<br />
city centre, a UNESCO World Heritage site.<br />
The imprints of Portuguese, Dutch, and<br />
21 22<br />
British forces were evident in churches, ancient landmarks and<br />
colonial structures. Most delightful were the vibrantly decorated<br />
23<br />
trishaw bicycles encircling the city centre fountain, their drivers<br />
beckoning to show you the town’s sights. Our group visited<br />
Christ’s Church, the hilltop ruins of St Paul’s, and the remnants of<br />
the Portuguese fort. On Jonker’s street in Chinatown, we<br />
explored the magnificent Cheng Hoon Teng temple, believed to be<br />
the oldest Chinese temple in Malaysia. We boarded the buses for<br />
an after-dark arrival in KL, the brightly lit PETRONAS Towers<br />
standing proudly in the distance to welcome us.<br />
Thursday, we, the guests, visited nearby Putrajaya, an<br />
“Intelligent Garden City”. This planned city became the new<br />
federal administrative centre of Malaysia in 1999 to relieve some 24<br />
of the overcrowding and congestion of KL. We started our tour at<br />
the Taman Warisan Pertanian, an agricultural park where we<br />
learned about Malaysia’s traditional crops, like rubber trees, a<br />
huge variety of palms, fruits, herbs and spices. We then drove<br />
around to see the town’s impressive architecture: government<br />
buildings, temples, monuments, and bridges. Putrajaya Seafood<br />
Restaurant served us a Chinese lunch in their pleasant lakeside<br />
location.<br />
The guided portion of the day ended in Kuala Lumpur, to see<br />
the views from the KL Tower, which was recently featured on the<br />
American television show ‘The Amazing Race Asia’. The rest of<br />
the afternoon was free and many guests decided to enjoy the 25<br />
beautiful Hilton Hotel rooftop pool for a refreshing swim. We later<br />
joined our companions for supper at the Royal Selangor Club, a<br />
prestigious social club founded in 1884.<br />
Our last sightseeing day was a brief KL city tour on Friday.<br />
The remainder of the day was open for much desired shopping.<br />
The colourful Central <strong>Mar</strong>ket offered local crafts and bargains in<br />
cool air conditioning.<br />
NOT FOR RE-PRINTING<br />
©<br />
Kuala Lumpur<br />
21.<br />
The elegant and<br />
soaring KL Tower<br />
22.<br />
The twin Petronas<br />
Towers dominate the<br />
skyline<br />
23.<br />
The beautiful rooftop<br />
pool at the Hilton<br />
24.<br />
Traditional produce on<br />
view at Taman Warisan<br />
Pertanian<br />
25.<br />
The Putra Mosque<br />
completed in 1999 is<br />
part of the “Intelligent<br />
Garden City” Putrajaya<br />
The final evening gala brought the entire group back together<br />
at the Hilton Hotel. Local artists creating caricatures, Chinese<br />
scripts, and batik style pictures entertained us at the friendly<br />
reception. After a sumptuous meal, cultural dancers performed. Brief speeches from our gracious president, Claire Porter, and others<br />
included accolades and farewells, <strong>with</strong> a tease of the fantastic plans for the 20<strong>12</strong> centenary celebration of the <strong>IRSE</strong> in London. The<br />
program was concluded <strong>with</strong> live music and dancing. Afterward, members and guests reminisced, talked of extended travels, made<br />
plans for the next year, and said their goodbyes. Thank you to the coordinators for another informative and enjoyable event.<br />
16<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong>
<strong>IRSE</strong> International Convention: The Future Beckons<br />
Contributors: Stephen Backway (Australia), Ramnesh Bansal (Canada), Stuart Coomer (UK), J.I.D.Jayasundara (Sri Lanka),<br />
Mency Mathew (UK), Shiv Mohan (Dubai), Swati Prusty (UK), Nikhil Swami (India), John Theo (Australia)<br />
The 2011 Hewlett-Fisher Bursary was<br />
awarded to ten Young Members to attend<br />
the <strong>IRSE</strong> International Convention held in<br />
Singapore and Malaysia from 9-14 October.<br />
This was a great opportunity for the Young<br />
Members to interact <strong>with</strong> leaders in the<br />
field and further develop a foundation via<br />
technical presentations and site visits.<br />
The two countries, Singapore and Malaysia,<br />
provided a contrast in their railway systems<br />
and modernisation progress. This article is<br />
written by the recipients of the 2011<br />
Hewlett-Fisher Bursary.<br />
We joined Claire Porter, Chair, and<br />
Colin Porter, Chief Executive and<br />
Secretary, for lunch at BREWERKZ on<br />
Clarke Quay on Sunday, 9 October, which<br />
was a great opportunity for everyone to<br />
meet and discuss aspirations for the<br />
convention. Common themes included<br />
interacting <strong>with</strong> industry leaders, discussing<br />
career direction, understanding different<br />
railway modernisation policies, and site<br />
visits. With the afternoon free of activity,<br />
some of us decided to take in the sites<br />
which included visiting China Town and a<br />
Buddha Temple. The evening allowed for<br />
registration and opportunity to mingle <strong>with</strong><br />
the Senior Members. Claire and Roger<br />
Penny, Convention Coordinator, greeted<br />
the members and guests <strong>with</strong> a welcome<br />
speech and outlined the week’s activities.<br />
The first half of the convention took<br />
place in Singapore where three bodies are<br />
responsible for the transportation system.<br />
The Land Transport Authority (LTA) focuses<br />
on planning the railway network, and the<br />
Singapore Metro Rail Transit (SMRT) and<br />
the Singapore Bus Services (SBS) Transit<br />
operate the transportation systems.<br />
Singapore has a fully integrated transit<br />
system where even the taxis are operated<br />
by the SMRT. On the first day attendees<br />
were presented <strong>with</strong> the past, present and<br />
future of the Singapore and Malaysia<br />
railways (view side bars) by Charles Page,<br />
Vice President of Business Development<br />
<strong>with</strong> Invensys. Singapore has one of the<br />
highest metro reliability ratings in the world,<br />
which is strongly set by the government.<br />
Charles outlined an aggressive plan for<br />
Singapore’s expansion in the next 25 years.<br />
NOT FOR RE-PRINTING<br />
©<br />
Historical Milestones<br />
Malaysia<br />
1885: First steel wheel/steel rail railway<br />
from Taiping to Port Weld,<br />
servicing tin mines<br />
1896: Federated Malay States Railway<br />
created Initial four major lines<br />
built are joined up<br />
1900: The main backbone of railway<br />
tracks linked Penang to<br />
Seremban.<br />
Singapore<br />
1877: Tanjong Pagar Dock Steam Railway<br />
1891: Kranji Electric Tramway experiment<br />
1903: Singapore-Kranji Railway<br />
Extended to the Wharf in 1907<br />
1905: Public electric tram service: -<br />
26 Miles and 60 Trams. Closed in<br />
1927<br />
Singapore and Malaysia<br />
1923: Singapore-Johor causeway<br />
completed - rail journeys to Malaysia<br />
begin from Woodlands on the northern<br />
coast of Singapore<br />
Present and Future<br />
Malaysia<br />
Mainline: KTMB Intercity and Komuter<br />
(1885), Express Rail Link Sdn Bhd (2002)<br />
MRT: Ampang* (1996), Kelana Jaya (1998),<br />
Kelana Jaya and Ampang Extensions<br />
(2013), Klang Valley MRT – Green, Red,<br />
Circle (2020)<br />
Monorail: KL (2003)<br />
Singapore<br />
LRT: Bukit Panjang (1999), Sengkang<br />
(2003) Punggol (2003)<br />
MRT: North-South (1987), East-West<br />
(1987), North East* (2003), Circle (2009),<br />
Downtown (In Progress), Thomson<br />
(2018), Eastern Region (2020), Tuas<br />
Extension (2018)<br />
* Signalling upgrades planned<br />
In contrast, the Railways of Malaysia<br />
consists of a wider range of railway<br />
systems and technologies attributed to<br />
the fact that the geography of Malaysia is<br />
well over 400 times larger than Singapore<br />
in terms of landmass. The operating<br />
bodies are Keretapi Tanah Melayu Berhad<br />
(KTMB) for mainline, rapidKL for metro,<br />
Express Rail Link Sdn Bhd for airport<br />
express, and Kuala Lumpur (KL) Monorail.<br />
Malaysia is advancing the<br />
modernisation of its mainline through<br />
double tracking and electrification of the<br />
North South line. The Ministry of<br />
Transport has planned the next ten years<br />
of railway modernisation and<br />
development, which is challenged by<br />
inconsistent government policy. The<br />
remaining presentations were by signalling<br />
suppliers providing a high level overview<br />
of the application of Communication<br />
Based Train Control (CBTC) <strong>with</strong> topics<br />
including the Operation Control Centre<br />
(OCC), energy efficiency, and lessons<br />
learned implementing CBTC.<br />
We spent the afternoon visiting site<br />
locations operated by the SBS Transit.<br />
The first stop was the Sengkang LRT,<br />
which is a suburban feeder to the North<br />
East line. This is one of three fully<br />
automated, Unattended Train Operation<br />
(UTO), LRT systems in Singapore.<br />
Mitsubishi Heavy Industries' Crystal Mover<br />
rolling stock has been supplied <strong>with</strong> the<br />
application of a Kyosan loop-based CBTC<br />
variant.<br />
The second stop was the Sengkang<br />
depot connecting to the North East line,<br />
which is an Alstom based CBTC signalling<br />
system. It is interesting to note that the<br />
OCC is supplied by Thales. The site tours<br />
provided ample opportunity for us to<br />
interact <strong>with</strong> Senior Members who<br />
provided insights into industry and site<br />
related topics.<br />
On the second day, Frank Young,<br />
Business Development Director of the<br />
SMRT, stated SMRT`s purpose is to build<br />
communities, not metro systems. Both<br />
the SMRT and SBS Transit are profitable<br />
organisations owned by the government.<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong> 17
<strong>IRSE</strong> CONVENTION - PART 2<br />
Frank openly responded to inquiries on how railway<br />
organisations can create sustainable profits:<br />
1) sale and lease of surrounding property;<br />
2) increasing retail space;<br />
3) installation of fibre optics;<br />
4) increasing advertisements.<br />
The following presentations focused on the application of CBTC<br />
<strong>with</strong> respect to system architecture, challenges, and best<br />
practices.<br />
A common theme by the CBTC presenters was the emphasis<br />
on teamwork between all parties during and after a project. It is<br />
interesting to note that the Downtown line will consist of full<br />
UTO <strong>with</strong> the addition of coded track circuits supporting a fall<br />
back solution allowing the train to automatically drive to the next<br />
station.<br />
In the afternoon, we visited the Kim Chuan Depot which is<br />
constructed underground to store trains for the Circle line and<br />
the upcoming Downtown line. Members were amazed <strong>with</strong> the<br />
Automatic Storage and Retrieval System which is capable of<br />
storing five years of materials and parts to support maintenance.<br />
From the depot we moved on to observe the various electrical<br />
and control rooms associated <strong>with</strong> the Circle Line: Depot,<br />
Signalling, and OCC. Since all the systems in Singapore are UTO,<br />
train drivers are required to perform a mandatory forty hours of<br />
manual driving annually. For the last night in Singapore, we<br />
headed to Long Bar, Ruffles Hotel to enjoy a few drinks and take<br />
in the live music. The following day, the delegates shifted from<br />
Singapore to Kuala Lumpur, <strong>with</strong> a stop in Malacca (also Melaka).<br />
The town of Malacca was once a prosperous trading post<br />
that endured centuries of colonisation by the Portuguese, Dutch,<br />
British and Chinese which have influenced the architecture of the<br />
town. The town has been awarded World Heritage City status<br />
by the UNESCO as of July 2008. We toured the religious sites<br />
which were surprisingly located close to one another. We visited<br />
St Paul’s Hills where a church dating back to 1521 AD was<br />
constructed by the Portuguese and later used by the British for<br />
storage of gunpowder. Afterwards, we boarded a bus for the<br />
remainder of the trip to Kuala Lumpur.<br />
The trip to Kuala Lumpur provided ample opportunity for us<br />
to reflect on our time in Singapore and discuss challenges faced<br />
by different bodies of the railway industry: suppliers, customers,<br />
and operators. The Young Members, representing various<br />
bodies, discussed and gained insights into the challenges faced<br />
by each group.<br />
After arriving in Kuala Lumpur, the evening was free of<br />
events, which was a great chance to enjoy the night life. The<br />
Young Members, consisting of a strong Indian contingency,<br />
dined at an Indian restaurant where dishes were shared<br />
providing a great bonding experience.<br />
The next day was the first of the convention in Kuala Lumpur.<br />
This began <strong>with</strong> a trip aboard the KTMB`s Electric Train Set (ETS)<br />
service which has been in revenue service for a year. The ETS<br />
runs on the recently electrified, high-speed commuter double<br />
track along the west coast of Malaysia. The conference<br />
delegates boarded at KL Sentral and enjoyed services<br />
comparable to the airlines. The onboard service staff provided<br />
beverages and meals for the two hour journey to Batu Gajah,<br />
18<br />
NOT FOR RE-PRINTING<br />
©<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong><br />
location of the Malaysian Railways Training Academy (MRTA).<br />
The ETS reaches speeds of 140 km/h, where the Automatic<br />
Train Protection (ATP) activates if the actual speed exceeds the<br />
permitted speed by 9 km/h.<br />
Dr. Aminuddin Adnan, MRTA Director, provided insights<br />
into the Malaysian railway industry and explained how the<br />
MRTA represents the hub of Malaysia’s railway vision for the<br />
next twenty years.<br />
Following presentations by the <strong>IRSE</strong>, members focused on<br />
the application of interlocking technologies, and the complexity<br />
of today’s systems by Wayne McDonald and Brian Smith<br />
respectively. A lively debate ensued between the presenters<br />
and audience regarding the increasing level of complexity of<br />
today’s signalling systems. Discussions also focused on the<br />
different transportation systems in Malaysia and how an<br />
integrated system is necessary. In the afternoon the delegates<br />
toured the Batu Gajah Depot.<br />
On the final day, the morning activities consisted of visiting<br />
the KL Sentral Station Centralised Traffic Control (CTC) for the<br />
Klang Valley, Rawang-Ipoh and Sentul Batu Caves double<br />
tracks. Timetables are produced twice daily and conflicts are<br />
addressed via Automatic Train Regulation (ATR). The afternoon<br />
technical visit took place at the Wisma Monorail Centre.<br />
The KL Monorail currently has an annual ridership of 1.3<br />
million people. The monorail runs using a two car pair which<br />
will be replaced <strong>with</strong> four cars in 20<strong>12</strong>. The system is an ATP<br />
System provided by Ansaldo where trains are prohibited to stop<br />
between stations, <strong>with</strong> the longest station separation being<br />
approximately 500 m. An interesting observation is that the<br />
switch move time, requiring the entire beam to change position,<br />
takes approximately 20-25 seconds as demonstrated by the OCC.<br />
The Convention Gala took place at the KL Hilton and was a<br />
wonderful conclusion to the week. Cultural shows provided the<br />
<strong>IRSE</strong> members and guests a taste of the Malaysian mix of<br />
ethnicities. The guests presented Claire <strong>with</strong> a gift as being the<br />
first <strong>IRSE</strong> female president, helping bring the <strong>IRSE</strong> towards<br />
centenary in 20<strong>12</strong>. The 20<strong>12</strong> convention will be held in<br />
conjunction <strong>with</strong> the Aspects Conference in October 20<strong>12</strong> in<br />
the United Kingdom in celebration of the centenary. We thank<br />
the <strong>IRSE</strong> team for the opportunity to attend the 2011 <strong>IRSE</strong><br />
International Technical Convention <strong>with</strong> the support of the<br />
Hewlett-Fisher Bursaries. This experience has become a<br />
foundation for our future careers.<br />
Younger Members, from left to right: John Theo, Stuart Coomer, Shiv Mohan,<br />
Aidan McGrady, Stephen Backway, Swati Prusty, Nikhil Swami, Mency Mathew, and<br />
Ramnesh Bansal.<br />
Photo: Aidan McGrady<br />
A picture of Young Members <strong>with</strong> Claire Porter at the <strong>IRSE</strong> International<br />
Convention Gala can be found on page 25 (inside back cover)
<strong>IRSE</strong> MATTERS<br />
<strong>IRSE</strong> Professional Examination: Results 2011<br />
148 candidates sat the exam around the world this year, <strong>with</strong> a total of 290 modules taken. The overall pass<br />
rate was a disappointing 39%, down from a more typical 48% pass rate in recent years.<br />
Surname Forename M1 M2 M3 M4 M5 M6 M7<br />
Anandhan Yokesh P<br />
Appunni Sumesh P<br />
Bhasin Rahul P<br />
Brouder Michael P<br />
Brown <strong>Mar</strong>tin Philip C C<br />
Brownhill James Christopher C<br />
Buchan Neil P<br />
Cavill William John D<br />
Chaudhary Ruchy P<br />
Cheuk Shun Wai P P P<br />
Chinnaraju Sasikumaran P<br />
Chiu Wang Chi C<br />
Chung Kei Hung P<br />
Clarke Graham James William P<br />
Devaraju Ambika P<br />
Fannon James P<br />
Floyd Graham P<br />
Gadkari Vaibhav P<br />
Garosi Matteo P C P<br />
Garratt Nathan Robin P P C<br />
Hayden Alastair P C<br />
Holmes Nigel Graham Thorpe P<br />
Jones Alud Rhys P<br />
Jones Gethin Rhys P<br />
Kasoju Sridhar P<br />
Kierans Liza P C<br />
Krishnan Lakshmi Narasimhan P<br />
Krishnan Subramanian P<br />
Kunapareddy Pavan Srikanth<br />
P<br />
Lau Wai Shing C P C<br />
Leach Jonathan David D C<br />
Madhukara S P<br />
Mahmoud Jehad P P<br />
McGovern Thomas C D C C<br />
McVea Colin William C P<br />
Mittal Princy P<br />
NOT FOR RE-PRINTING<br />
©<br />
Surname Forename M1 M2 M3 M4 M5 M6 M7<br />
Moorhouse Adrian C<br />
Mumford Jonathan D P<br />
Muriu Charles Kiama P<br />
Murugesan <strong>Mar</strong>uthaiyappan P<br />
Nagarajan Mohan Kumar P P<br />
Nagarajan Sugavanam C<br />
Narasimmalu Yuvaraj P P<br />
Nath Kedar C<br />
Neary Kevin D C P<br />
Newbury Elliott George C<br />
Newman Louise P<br />
Oakes Daniel Stuart C P<br />
O'Connell Joseph Xavier C P P<br />
Osler Laura Jane D C<br />
Papayannakos Panos Robert C P<br />
Paradza Peter P<br />
Paretha Deepak C<br />
Puckrin Ian James P<br />
Raikwar Prashant Sudhakar P<br />
Rajamani Vinoth P P<br />
Richardson Paul P<br />
Sankaran Radha<br />
Krishnan Hari Shankar P<br />
Selvakumaraswamy Azhagappan P<br />
Sharp Ian P P<br />
Smith Gregg Richard P<br />
Speak Jonathan P P<br />
Tandon Harshit C P P<br />
Thomas Bartholomew P<br />
To Ping Man Clara P C P P<br />
Turner Stuart P<br />
Waszkiewicz Artur P<br />
Wilkinson Alan D C P<br />
Wood Steven P P C P<br />
Yates Neil C<br />
Zhao Xi P<br />
P = Pass<br />
C = Credit<br />
D = Distinction<br />
<strong>IRSE</strong> PROFESSIONAL EXAM 20<strong>12</strong> CANDIDATES<br />
If you are planning to sit exam modules in 20<strong>12</strong>, please note that the exam application deadline is 30 June.<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong> 19
LU TECHNICAL SOCIETY<br />
London Underground’s Technical Society<br />
Report by Eddie Goddard<br />
On 17 January 20<strong>12</strong>, the “TechSoc” celebrated its first 50 years<br />
<strong>with</strong> a reception and presentation at the London Underground<br />
headquarters at 55 Broadway. Over 60 people attended including<br />
three past presidents of the <strong>IRSE</strong> (Victor Smith, Leslie Lawrence<br />
and myself). Both Leslie and Victor were able to give some<br />
insights into their past. Leslie described the legacy that Robert<br />
Dell has left in the basic principles that he laid down and that are<br />
still followed today. He emphasised that we should never forget<br />
that lives are at stake when we make decisions and that we should<br />
continually review the decisions made in the light of experience.<br />
THE FIRST YEARS<br />
The Signal and Electrical Engineers Technical Society (known by<br />
all as the TechSoc) was established by Robert Dell (the then Chief<br />
Signal Engineer of London Underground) under the chairmanship<br />
of Victor Smith in 1962. From the outset its aims were to provide<br />
a forum for technical debate and the exchange of information,<br />
opportunities to meet like minded people and most importantly<br />
to give young engineers a chance to develop contacts and their<br />
presentation skills.<br />
It always encouraged everyone in the department to join, and<br />
whilst the papers were by no means lightweight the whole<br />
atmosphere of the meetings was informal, and questions were<br />
encouraged. The membership was very broad including<br />
everyone from the lowest apprentice to the Chief Engineer. As a<br />
measure of how forward thinking they were the membership<br />
included (in no particular order) operators, mechanical engineers,<br />
maintainers, installers, admin staff and even the occasional civil<br />
engineer! All joined in and many of the most penetrating<br />
questions came from the administration staff.<br />
The list of papers reads like an encyclopaedia of London<br />
Transport Signalling. The first paper from Harry Hadaway covered<br />
the remote operation of signalling. This described the remote<br />
operation of signal levers in one cabin by an adjacent one. It<br />
described the air operation of the levers, the principles of route<br />
clearance and the introduction of the delta track circuit as a<br />
secondary means of determining that a train has passed through<br />
the route before it is released; an early application of diversity in<br />
safety signalling. This same principle has held good for over fifty<br />
years.<br />
NOT FOR RE-PRINTING<br />
©<br />
Later papers cover the introduction of programme machines<br />
for fully Automatic Route Setting, the introduction of Automatic<br />
Train Operation and Automatic Fare Collection (ARS, ATO and<br />
AFC - all before 1964)!<br />
The papers covered all aspects of signalling including a<br />
definitive work by Alf Thomas on testing a signalling installation,<br />
this became the bible for LU testers for many years, and by<br />
George Kent on the maintenance of signalling equipment.<br />
The presentations were not confined to London<br />
Underground signalling but included papers on Folkestone East<br />
and route setting on the Eastern region in the first year alone.<br />
They were not limited to signalling either – In the first two years<br />
there were papers on Permanent Way and Civil engineering, and<br />
even on Rolling Stock!<br />
From the outset attendance has been around forty to fifty<br />
per meeting <strong>with</strong> the occasional ones gaining audiences in<br />
excess of a hundred.<br />
VISITS<br />
Whilst not rivalling the <strong>IRSE</strong> Convention the society arranged a<br />
most impressive programme of technical visits. Indeed this was<br />
my real introduction to the society, and indeed to the signalling<br />
department and to signalling. The visits were informal, but<br />
highly instructive and nowadays would be seen as the ideal<br />
networking opportunity. One of my early memories is of Mr.<br />
Hadaway (when he was Chief Signal Engineer) coming around<br />
during one of the visits and chatting to us, a group of trainees.<br />
In those, rather formal, days this was a bit of a breakthrough.<br />
Although the visits started as UK based, covering oil<br />
refineries, signalling installations and air traffic control, they soon<br />
broadened their wings and spread from Europe, to Moscow,<br />
America and even Hong Kong<br />
1. Diagram taken from H W Hadaway paper<br />
2. The high days of visits<br />
3. Technical Presentation during a visit<br />
4. Visit to Neasden Depot<br />
1 2<br />
20<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong>
MANAGEMENT OF THE SOCIETY<br />
The Managing Committee<br />
The TechSoc has always depended on a loyal band of volunteers<br />
to form the management committee, drawn from the membership<br />
as a whole. The role call is like a who’s who of LU signalling.<br />
The first chairman was Victor Smith; Leslie Lawrence, Malcolm<br />
Heaton, Eric Eden and Norman Hurford were among the many<br />
who gave up their time to further the society. Today’s<br />
committee continues this tradition and includes representatives<br />
from suppliers, and consultancies as well as LU employees.<br />
The Membership<br />
The membership has been surprisingly constant over the years at<br />
around 500, of which over 300 are active members.<br />
With the advent of the Public Private Partnership (PPP) and<br />
the progressive effect of budget cuts the society has had to<br />
change. Membership is now open to anyone that is, or has,<br />
carried out work for London Underground. This includes the PPP<br />
partners, suppliers and sub contractors. As a result the TechSoc<br />
represents a healthy cross-section of the railway industry as it has<br />
retained its open door policy and does not restrict membership<br />
to engineers alone.<br />
The generous support that was available from LU in the past<br />
has been replaced by securing industry wide sponsorship,<br />
<strong>with</strong>out which the TechSoc would not be able to survive.<br />
THE SOCIAL SOCIETY<br />
A major feature of the TechSoc has always been its friendly<br />
atmosphere. It provides an opportunity for members to meet<br />
and to exchange knowledge, memories and indeed to develop<br />
friendships that span the companies, generations and sexes! The<br />
local hostelries do a good trade post meetings and the contacts<br />
made serve us all well.<br />
THE LEARNING SOCIETY<br />
From the outset the TechSoc has always encouraged young<br />
engineers to join. As well as providing a means for them to meet<br />
the leaders in the industry in an informal atmosphere it gives an<br />
opportunity to develop presentation skills in a friendly atmosphere.<br />
(Indeed my first professional presentation was given to<br />
the Society when, as a Technical Assistant, I outlined the<br />
potential role of computers in signalling in a paper in 1972, to an<br />
audience that included my peers, my bosses and Harry Hadaway<br />
himself).<br />
THE SOCIETY TODAY<br />
The TechSoc now is as strong as it ever was. The meetings<br />
continue to be well attended, and it attracts a stellar cast of<br />
presenters.<br />
In the past year the presentations have included London<br />
Overground, Benchmarking, Field Metrology (yes measuring not<br />
weather), and Network Rail’s Modular signalling, and over the<br />
past couple of years Rod Muttram, Siv Bhamra and Dave Fenner<br />
have all given presentations to the society.<br />
NOT FOR RE-PRINTING<br />
©<br />
Whilst the days of world travel are over the society continues<br />
to arrange technical visits which are generally oversubscribed.<br />
This year the visits were to the East London Line and to Neasden<br />
Depot.<br />
Forthcoming events<br />
The remaining presentations for this season are on Crossrail<br />
stations and communications systems, the new signalling for the<br />
Metropolitan and District Lines, and the Cable car to the O2<br />
arena.<br />
The following season will include the Heathrow T5 people<br />
mover (fully automatic taxis), updates on the Crossrail and LU<br />
Subsurface signalling, the operators’ experience of the upgrades<br />
on the Victoria and Jubilee Lines, and the Olympic experience.<br />
Visits to the T5 people mover and hopefully to the Olympics<br />
after the event!<br />
Library<br />
Members have access to an extensive library and to the back<br />
catalogue of papers, (the early papers have all been scanned and<br />
provide a rich source of information).<br />
HOW TO JOIN<br />
The society’s website (http//www.techsoc.org.uk) gives details<br />
of how to join and more information on upcoming events.<br />
For any queries the society’s email address is<br />
committee@techsoc.org.uk.<br />
3<br />
4<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong> 21
YORK SECTION<br />
Report by Andrew P Smith<br />
Tony Pinkstone, Chairman of the York Section, welcomed 33<br />
members to the first meeting of 20<strong>12</strong>.<br />
Tony introduced Stephen Cox, Head of Signalling and<br />
Software, Balfour Beatty Rail Technologies and invited him to<br />
present his paper, “Tools to Assist in the Testing of Signalling<br />
Systems”.<br />
Stephen began by outlining his career which has been initially<br />
in electronics and software. After joining BR as a sponsored<br />
student in 1993 he went on to join Eastern IMC at privatisation<br />
and thence to Balfour Beatty Strategic Development Group. This<br />
became BB Rail Technologies in 2002 and he is now Head of<br />
Signalling and Software, BB Rail Technologies.<br />
The current signalling renewals process consists of five major<br />
elements, specify, design, install, test and commission. Of these<br />
elements testing and commissioning comprises, inspection,<br />
preparation testing, set to work, functional testing, control table<br />
testing, principles testing and correspondence testing some of<br />
which can be categorised as either testing or commissioning. If<br />
an error is found during this process then a test log is produced,<br />
which may need further specification, design, installation and<br />
then testing and commissioning. The current testing process can<br />
be very repetitive, it can take place in all weathers and at all<br />
times of day or night, it often takes place during short<br />
possessions increasing pressure. It relies on the experience and<br />
competence of individual testers and it is true to say that testers<br />
are the “last line of defence” <strong>with</strong> very few tools to assist them.<br />
Tools available to them at present are; personal tools consisting<br />
of multi-meter, insulation tester, test straps, Strength & Polarity<br />
meter and track circuit shunt box. System Tools include test desk<br />
switch box, SSI TFM generator and dummy loads. BB Rail<br />
instigated a project to provide tools to assist in the testing<br />
process <strong>with</strong> the aim of making tests and results more “visible”<br />
to the tester, carry out repetitive tasks automatically in a<br />
consistent manner and record results for fault investigation and/<br />
or audit purposes. This was to enable as much testing as<br />
possible to be carried out prior to the commissioning possession.<br />
A computer was employed to provide inputs to the signalling<br />
system <strong>with</strong> the outputs being monitored to confirm the correct<br />
operation of the signalling system.<br />
CATS Mk1 (Computer Aided Testing System) was developed<br />
<strong>with</strong> the aim of using a standard desk top PC to provide the<br />
inputs to the signalling system, via miniature relays, <strong>with</strong> the<br />
outputs fed into an event recorder. This system was used at<br />
Stenson Junction to test the interlocking which was a WESTPAC<br />
Mk111 geographical system commissioned in the 1960s. This<br />
involved taking the existing wiring diagrams to determine which<br />
pins on the set plug couplers could be treated as inputs and<br />
outputs. Then it was necessary to write software which could<br />
accept and model the set logic, enter the logic into the software<br />
to allow it to model how the set was designed to operate, write a<br />
sequence of steps to function the set as much as possible from<br />
the plug couplers. The Interface CATS Mk1 was interfaced to the<br />
set plug couplers and software was written which could replay<br />
the sequence of steps in real time against the model and<br />
determine if the actual set was behaving in the same way as the<br />
model. The testing revealed a total of 77 individual faults<br />
identified over the 24 hour testing period. This included, wrong<br />
NOT FOR RE-PRINTING<br />
©<br />
relays types (single wound instead of double wound / wrong<br />
contact arrangements), incorrect wiring <strong>with</strong>in the geographical<br />
set (missing wires / wires in the wrong place), faulty wiring <strong>with</strong>in<br />
the geographical set (badly crimped / soldered wires), poor<br />
electrical contact between the relay base and the relay (bent<br />
crimps / relay contacts), and out of specification relays (open<br />
circuit / short circuit faults <strong>with</strong>in the relay). Following the<br />
commissioning lessons were learnt such as, the front end did not<br />
provide sufficient information to diagnose the cause of a fault,<br />
communication problems occurred between the CATS operator<br />
and the person in the relay room, it’s cold and damp in a tent at<br />
4am and electronics and operators don’t like it !! CATS Mk11<br />
was developed which had a specifically designed card which can<br />
feed out +50V, 0V or switched contact AND detect +50V or 0V<br />
(also built in short circuit detection). These cards fit into a<br />
standard 19” rack mountable case (up 14 cards per rack) and<br />
standard 25 way connectors allow access to the channels from<br />
each card. Each card has a unique address <strong>with</strong>in the system<br />
taken from its case and position <strong>with</strong>in the case. Power supply<br />
provides low voltage to drive card electronics and 50V to drive<br />
the signalling system. The software was re-designed to simplify<br />
operation and feedback to user. CATS Mk11 has been<br />
successfully used on WESTPAC geographical, GEC geographical,<br />
free wired systems and level crossings. The future of CATS is<br />
provide automated measurement of relay contact resistances,<br />
automated set to work of interlocking, automated routineing of<br />
locations, Relocatable Equipment Buildings and level crossings<br />
and Automated control table testing.<br />
In conclusion Stephen has shown that it is possible to<br />
produce tools which assist the tester in their task and there is a<br />
need to think about the methods of testing when designing new<br />
systems. However many systems are now becoming too<br />
complex for traditional manual testing methods (ERTMS, Traffic<br />
Management) and so Computer Aided Testing is necessary.<br />
Two questions remain:<br />
how do we test train and track based systems?<br />
how do we test “intelligent” systems?<br />
Those taking part in the discussion were Bruce MacDougall,<br />
Quentin Macdonald, John Maw, Tony Pinkstone, Kevin<br />
Williamson and Colin Ward. The vote of thanks for an<br />
entertaining and informative evening was given by Grace Nodes.<br />
FEEDBACK<br />
RE: ETCS Level 2 Application on the Cambrian<br />
In my 52 years of messing about <strong>with</strong> signalling schemes, I had<br />
on numerous occasions reason to thank Peter Woodbridge for<br />
his efforts on my behalf. There was Exeter, Paddington and<br />
Great Eastern Resignalling to name just a few.<br />
Having read Peter’s marvellous reply (twice and still<br />
pondering) to Phil Hingley’s letter in the December issue, I must<br />
thank Peter yet again. He has convinced me that I retired not a<br />
day too soon.<br />
Tim Oakes M<strong>IRSE</strong> (Retired)<br />
22<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong>
MIDLAND & NORTH WESTERN SECTION<br />
Report by Ian Bridges<br />
The Section opened 20<strong>12</strong> <strong>with</strong> a talk at by Nick Rushby of<br />
Conation Technologies at Network Rail’s Walsall training centre.<br />
Nick’s talk entitled Technology Based Training for the 21 st<br />
Century Railway considered modern training techniques and how<br />
they can be best used. Starting <strong>with</strong> a bit of history he discussed<br />
how there has been a very conservative approach to training in<br />
the railway industry, where apart from driver training, there has<br />
been very little use of simulator based training, instead the<br />
traditional teach, multiple choice question, pass/fail process is<br />
still very much in evidence.<br />
Often training is one of the first items that is cut from a<br />
company budget when times get hard, and yet in 2008 it is<br />
believed there was a cost of around £1bn to the UK economy<br />
caused by late trains. Although delay minutes have continued to<br />
drop since then, the cost per minute has risen, so it is likely that a<br />
similar cost is still incurred today. It is, therefore, essential that<br />
the time to repair equipment falls in order to reduce the delays<br />
further, which often means more extensive and better training.<br />
Nick continued by talking about record keeping. Prior to<br />
privatisation, around 1995, there was one company that managed<br />
most industry training and kept almost all of the records. Now,<br />
in a fragmented industry, this has become very much more<br />
difficult <strong>with</strong> many hundreds of companies participating in the<br />
delivery of projects and services to Network Rail. Indeed,<br />
storage of records is a big part of the business overhead for<br />
small companies. A product called NovaRail is at hand and may<br />
be used to resolve some of these issues. Sitting at the centre of<br />
a hub, the system can be used to hold on-line records, provide<br />
discussion forums, e-assessments and manage Continuing<br />
Professional Development (CPD).<br />
The Clapham railway accident on the <strong>12</strong> December 1988<br />
changed the face of training. Anthony Hidden QC said that the<br />
railway industry training needed a complete overhaul, following<br />
which British rail spent £13m over three years to develop<br />
NOT FOR RE-PRINTING<br />
©<br />
2000 hours of training materials. Some of this material came into<br />
everyday use, such as signalling tester training modules, but the<br />
majority of it was ‘lost’ due to the privatisation process. Some of<br />
this material has been found and is now being resurrected and<br />
may once again provide a future watershed.<br />
Nick finished his talk by discussing projects he had helped<br />
the Railway Safety and Standards Board <strong>with</strong> and an example of how<br />
trainers working <strong>with</strong> product developers can reduce the future<br />
training burden. The example centred on the Park Signalling<br />
manufactured Trackside Radio Control Unit. Once introduced,<br />
the client wanted a 5-day training course to be written in order<br />
to train technicians how to maintain the equipment.<br />
Following a meeting on how the course would be developed,<br />
it was decided that by spending a little more money to achieve<br />
more on-board analysis <strong>with</strong>in the system, the diagnostics would<br />
make it a lot easier to identify any faults that may occur. As a<br />
result the need for a five day training course was cut to a three<br />
day requirement.<br />
This provides a good example of training organisations and<br />
manufacturers working in perfect harmony.<br />
The Section’s thanks go to Nick for his talk and to Network<br />
Rail for providing the facilities for the evening.<br />
Photos: M&NW committee meeting at Walsall Training Centre, and the Centre itself<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong> 23
ANNOUNCEMENTS<br />
SIMS signals the go ahead for more apprenticeships<br />
SIMS – experts in railway signalling, installation & maintenance<br />
services – has launched a search for two new apprentices.<br />
Despite mass youth unemployment the industry is failing to<br />
attract new recruits and as a result the pool of licensed signalling<br />
staff is limited and falling.<br />
SIMS Managing Director, Tony Steer - having been a London<br />
Underground apprentice himself - is looking to reverse this trend<br />
“With only eight per cent of British employers now offering<br />
apprenticeships, we decided to buck this trend and increase the<br />
pool of licensed signalling engineers”.<br />
But a railway apprenticeship might not be everyone’s cup of<br />
tea. “Carrying out a highly skilled job on railways is very<br />
demanding”, said Matthew Hill and Jordan Philip, last year’s<br />
apprentices. “The hours are long and often anti-social and it is<br />
very different from a regular office job, being predominately<br />
outside in all weather conditions. The job is very technical and<br />
there’s no room for error. But it’s a brilliant opportunity to build<br />
a steady career in the railway industry”.<br />
The SIMS Apprenticeship Scheme – which takes between two<br />
and three years to complete – combines classroom study, practical<br />
on-the-job mentoring from senior engineers and a comprehensive<br />
education in the various aspects of railway signalling. At the end<br />
of the scheme the apprentices will possess qualifications in<br />
installing, testing signalling systems, construction skills, London<br />
Underground track competence as well as City & Guilds Level 3<br />
Certificate in Engineering, Installation Commissioning and<br />
Maintenance. They will leave <strong>with</strong> an <strong>IRSE</strong> licence, enabling them<br />
to work on the railway from the day they qualify.<br />
NOT FOR RE-PRINTING<br />
©<br />
MIDLAND & NORTH WESTERN SECTION<br />
Ninth Annual Luncheon & Technical Visit<br />
Saturday 30 June 20<strong>12</strong><br />
Great Central Railway<br />
The scheme’s classroom study includes formal education at<br />
Newham College, on a block release arrangement for the first<br />
year, and then on day-release. To ensure the right course is<br />
chosen to meet the apprentices’ needs, the College carries out a<br />
test of academic abilities. The SIMS Apprenticeship Scheme is<br />
very hands-on and candidates gain experience of installation and<br />
T&C work <strong>with</strong>in the industry, gaining familiarity <strong>with</strong> new and<br />
existing systems and assets, both in equipment rooms and<br />
trackside. They also get the opportunity to carry out some work<br />
themselves, checked by the on-site supervisor.<br />
Tony Steer commented on the recent SIMS Apprenticeship<br />
Scheme Graduates “In just over two years we turned out two<br />
railway technicians <strong>with</strong> the skills and foundations to immediately<br />
contribute to the industry. They have achieved a good entry<br />
level in an industry that is moving forward. We have a continued<br />
commitment to our apprentices and look forward to recruiting<br />
another intake for 20<strong>12</strong>. The scheme has greatly improved<br />
company morale and has proven a positive experience for all<br />
involved. The whole team were pleased to pass on their<br />
knowledge to the next generation of technicians. We now have<br />
new human resources available to the industry, only two so far<br />
but it’s a great start.”<br />
To find out more information about how to apply for the<br />
20<strong>12</strong> SIMS Apprenticeship Scheme, potential candidates should<br />
contact:<br />
Kay Richmond, kay.richmond@sims-uk.com<br />
Deadline for applications is 31 <strong>Mar</strong>ch 20<strong>12</strong> and applicants<br />
should be 18 or over.<br />
Photo: Ian James Allison<br />
The committee of the Midland & North Western Section have<br />
again agreed this year to return to a previous venue of our<br />
successful Luncheons, located in the East Midlands of the UK.<br />
We have secured places for up to 84 guests and seek the support<br />
from the whole of the Institution world-wide, to make this yet<br />
another successful and enjoyable family event. This event will<br />
celebrate the commissioning of S<strong>with</strong>land Sidings Signal Box<br />
upon this railway and see some unique activity of our luncheon<br />
train on a busy main line!<br />
Voted number <strong>12</strong> on the list of the 50 greatest railway<br />
journeys in the world, the Great Central Railway is the UK's only<br />
double-track main line heritage railway. It is the only place in the<br />
world where full size steam engines can be seen passing each<br />
other – just as it was when steam ruled the rails. Trains run every<br />
weekend of the year, bank holidays and selected week days<br />
through the summer. In addition, First Class Restaurant Car<br />
Services provide five course meals, whilst travelling between<br />
Loughborough and Leicester. For further details, please go to<br />
www.gcrailway.co.uk.<br />
The cost of the visit to attend, including train tickets and<br />
luncheon (excluding beverages) is currently being reviewed and<br />
we are also seeking a sponsor for this event. To confirm your<br />
attendance and for further details, please send an email including<br />
individual names of those planning to attend to<br />
irsenews@btinternet.com. If your company wishes to sponsor<br />
this event, please also contact irsenews@btinternet.com.<br />
Please note that the Institution and administrations whose<br />
sites are visited on technical visits cannot accept responsibility for<br />
any injury, damage or other difficulty which may arise.<br />
Participants are therefore advised to ensure that their own<br />
insurance covers all appropriate eventualities.<br />
Ian James Allison, Visits Secretary<br />
24<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong>
NOT FOR RE-PRINTING<br />
©<br />
THE WING AWARD FOR SAFETY<br />
CALL FOR NOMINATIONS 20<strong>12</strong><br />
The "Wing Award for Safety" was introduced in 1994 to commemorate the life and work of the late Peter Wing, a Fellow of this<br />
Institution and an employee of British Rail, who during his career made a major contribution to the cause of lineside safety.<br />
Peter Wing, whose career in BR spanned 31years, spent much of his working life dedicated to the safety his colleagues. It was<br />
his care and concern that became the driving force behind the national campaign in 1992/3 that was entitled “Dead Serious<br />
About Safety” and which had such a major impact in reducing the numbers of lineside fatalities in subsequent years.<br />
The Institution of Railway Signal Engineers administers the award scheme on behalf of Members of the Railway Group, the<br />
Railway Supply Industry and the Health & Safety Executive, who amongst others supported the formation of the Wing Award<br />
for Safety.<br />
Recent winners of the Wing Award have been:-<br />
The award takes the form of a certificate and an amount of £600 to be devoted to personal development and will be made<br />
to an individual who has made an outstanding personal contribution to railway lineside track safety by, for example, coming<br />
forward <strong>with</strong> a novel idea for improving safety at the lineside, is a long term champion of improving track safety standards or<br />
has made a significant contribution to the awareness of track safety in his business.<br />
2002 A Swann Safety Consultant<br />
2003 A Nelson Railway Safety<br />
2004 B West Amey Rail<br />
2005 P Broad Network Rail<br />
2006 C Wheeler Railstaff<br />
2007 G Bickerdike 4x3<br />
2008 S Cassidy Network Rail<br />
2009 M Wild Westinghouse Rail<br />
2010 D Deeley & J Mawby Network Rail<br />
2011 J Camp & S Henser Cleshar & MPI<br />
Any employee in a railway business or an associated industry is eligible for consideration for the Award and nominations are<br />
now invited for the 20<strong>12</strong> Award. Nominations should be sent to me at<br />
<strong>IRSE</strong>, 4 th Floor, 1 Birdcage Walk, Westminster, London, SW1H 9JJ, United Kingdom or hq@irse.org<br />
by not later than 18 <strong>Mar</strong>ch 20<strong>12</strong>, together <strong>with</strong> information not exceeding 250 words in support of the nomination.<br />
The award will be presented to the successful nominee at an industry function later in 20<strong>12</strong>.<br />
Colin Porter, Chief Executive<br />
<strong>IRSE</strong> Merit Awards<br />
, introduced in 2006, are awarded by the Council to a volunteer or staff member anywhere in<br />
the world to recognise meritorious service to the Institution. Nominations can be made by any member. Meritorious service is<br />
defined as making a substantial contribution to the Institution’s work over a period of time by organising activities, or carrying<br />
out specific tasks which have furthered the Institution’s aims and objectives. The award consists of a suitably engraved plaque.<br />
If you think of someone who should be considered for such an award, please contact the Chief Executive at hq@irse.org<br />
<strong>with</strong> details of why they should be considered.<br />
Younger Members Technical Papers Competition<br />
There is also to be a<br />
run in<br />
conjunction <strong>with</strong> ASPECT 20<strong>12</strong> later this year. Full details have been circulated to all younger members and are available on<br />
the Younger Members section of the web-site at http://www.irse.org/nearyou/default.aspx.<br />
“Older members” are asked to encourage their younger colleagues to enter the competition.<br />
Completed papers of 1000-2000 words have to be submitted to hq@irse.org by 30 April 20<strong>12</strong>.<br />
Colin Porter, Chief Executive<br />
Young Members <strong>with</strong> Claire Porter at the <strong>IRSE</strong> International Convention Gala (see article on Page 17) from left to right:<br />
Photo: Colin Porter<br />
Mency Mathew, Stuart Coomer, Stephen Backway, Lynsey Hunter, Claire Porter, Swati Prusty, Nikhil Swami, J.I.D.Jayasundara, John Theo, and Ramnesh Bansal.<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong> 25
MEMBERSHIP MATTERS<br />
ELECTIONS<br />
We extend a warm welcome to the following newly-elected members:<br />
Fellow<br />
Gao C H Beijing Traffic Control China<br />
Laube F Emch + Berger Bern Switzerland<br />
Liu C Ministry of Railway China<br />
Niu Y M Beijing Traffic Control China<br />
Tang T Beijing Jiaotong University China<br />
NOT FOR RE-PRINTING<br />
Member<br />
Adeosun A I Irish Rail Eire<br />
Cleary P A Parsons Brinckerhoff Int. India<br />
Currens J F Contractor<br />
Goodey N Sinclair Knight Merz Australia<br />
Hayes I P Ansaldo STS Australia<br />
Ho T K ORION Engineering Hong Kong<br />
Huang W Beijing Traffic Control China<br />
Huber B Projekthaus Herisau Switzerland<br />
Kiestra B H ProRail Netherlands<br />
Koch D Siemens Schweiz Switzerland<br />
Künneman G Siemens Switzerland<br />
Law S H K MTR Corporation Hong Kong<br />
Li L K H UGL Hong Kong<br />
Meijer J ProRail Netherlands<br />
Nipariyai N Ansaldo STS Australia<br />
Associate Member<br />
Burge G P Network Rail<br />
Echter J Strukton Rail Netherlands<br />
Gupta A K SRDSTE Central Rly. Office India<br />
Han Y Lloyd's Register Rail China<br />
Li J Lloyd's Register Rail China<br />
Liang J Lloyd's Register Rail China<br />
Sharma D K Infotech Enterprises India<br />
van Houten F J ProRail BV Netherlands<br />
Wang H Lloyd's Register Rail China<br />
Accredited Technician<br />
Matata T Network Rail<br />
Associate<br />
Aalbers M ARCADIS Netherlands<br />
Balla N R GE Trans Global Signaling USA<br />
Cross P D Rail Tech Group RSE<br />
Deacon S CWR Australia<br />
Dobson L W Ansaldo STS Malaysia<br />
Hughes D T W Balfour Beatty Rail Technologies<br />
Konelka A Network Rail<br />
Roubekas A TPG Systems<br />
Rymell J L Great Central Railway<br />
Welti S Sigdata Switzerland<br />
©<br />
Student<br />
McSorley C Parsons Brinckerhoff<br />
TRANSFERS<br />
Member to Fellow<br />
Knight A Signet Solutions<br />
Associate Member to Member<br />
Lau S P MTR Corporation Hong Kong<br />
Associate to Member<br />
Brown S J Network Rail<br />
Puckrin I J Network Rail Maintenance<br />
Student to Member<br />
Ingram P A Network Rail<br />
Thomas B Network Rail<br />
Accredited Technician to Associate Member<br />
Singh S B SERCO Middle East UAE<br />
Associate to Associate Member<br />
Chung K H Parsons Brinckerhoff Hong Kong<br />
Student to Associate Member<br />
Mackie A Parsons Brinckerhoff<br />
RE-INSTATEMENTS<br />
Bird<br />
<strong>Mar</strong>ques<br />
Reddy<br />
Salisbury<br />
Simtheam<br />
DEATHS<br />
A J<br />
R L<br />
N<br />
J M E<br />
A<br />
It is <strong>with</strong> great regret that we have to announce the death of the<br />
following member, who’s obituary was published in <strong>IRSE</strong> NEWS<br />
last month:<br />
Fell D H Associate<br />
Current Membership Total is 4805<br />
26<br />
<strong>IRSE</strong> NEWS | ISSUE <strong>176</strong> | MARCH 20<strong>12</strong>